US20200244557A1 - Traffic processing method, user plane apparatus, and terminal device - Google Patents

Traffic processing method, user plane apparatus, and terminal device Download PDF

Info

Publication number
US20200244557A1
US20200244557A1 US16/851,251 US202016851251A US2020244557A1 US 20200244557 A1 US20200244557 A1 US 20200244557A1 US 202016851251 A US202016851251 A US 202016851251A US 2020244557 A1 US2020244557 A1 US 2020244557A1
Authority
US
United States
Prior art keywords
network element
traffic
data packet
terminal device
plane function
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US16/851,251
Other languages
English (en)
Inventor
Shengxian Nie
Yang Xin
Xiaobo Wu
Weiwei CHONG
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Assigned to HUAWEI TECHNOLOGIES CO.,LTD. reassignment HUAWEI TECHNOLOGIES CO.,LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CHONG, Weiwei, NIE, Shengxian, WU, XIAOBO, XIN, YANG
Publication of US20200244557A1 publication Critical patent/US20200244557A1/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0823—Errors, e.g. transmission errors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2483—Traffic characterised by specific attributes, e.g. priority or QoS involving identification of individual flows
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/10—Active monitoring, e.g. heartbeat, ping or trace-route
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/32—Flow control; Congestion control by discarding or delaying data units, e.g. packets or frames

Definitions

  • Embodiments of this application relate to the field of communications technologies, and in particular, to a traffic processing method, and a user plane apparatus and a terminal device implementing the traffic process method.
  • Wi-Fi wireless-fidelity
  • other user equipment such as a mobile phone or a tablet computer
  • 3GPP 3rd generation partnership project
  • the Wi-Fi hotspot works like common wireless local area networks (WLAN) (namely, one of non-3GPP access manners).
  • the users may use a traffic-intensive service, such as an online video service, a virtual reality (VR) service, or an augmented reality (AR) service.
  • the provider of the Wi-Fi hotspot has no control of what kind of services a user can utilize when he or she accesses the cellular network through the Wi-Fi hotspot.
  • a traffic threshold a maximum amount of traffic allowed to be consumed in a single-time enabled state of the Wi-Fi hotspot. When the threshold is reached, the Wi-Fi hotspot is automatically disabled.
  • the Wi-Fi hotspot is automatically disabled if there is not a connection in a period of time.
  • the party enabling the hotspot can set parameters of the Wi-Fi hotspot, thereby controlling traffic consumption directly and preventing large fees from being incurred by abnormal traffic consumption.
  • the prior art method based on terminal parameter settings cannot truly resolve the problem of abnormal traffic. For example, although setting a password blocks access of untrusted user equipment and setting the maximum quantity of connected users also prevents access by more user equipment, a user that already has access can still use traffic-intensive services without notifying the party enabling the hotspot. Setting a traffic threshold can prevent traffic from exceeding the threshold, but an alarm is sent only after a large amount of traffic has been consumed, and a large amount of fees has already incurred.
  • Embodiments of this application provide a traffic processing method, a user plane apparatus, and a terminal device that implement the traffic processing method, to accurately identify abnormal traffic and improve traffic management.
  • an embodiment of this application provides a traffic processing method, including: receiving, by a user plane function network element, hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch is enabled; obtaining, by the user plane function network element, a characteristic parameter of a first data packet, and sending the characteristic parameter of the first data packet to a data analytics network element, where the first data packet is data obtained by the user plane function network element in a period in which the hotspot switch of the terminal device is enabled; and determining, by the user plane function network element, that traffic corresponding to the first data packet is abnormal traffic.
  • the user plane function network element determines, based on the hotspot indication information from the terminal device, that the hotspot switch of the terminal device is enabled.
  • the user plane function network element obtains the first data packet in the period in which the hotspot switch of the terminal device is enabled, and sends the characteristic parameter of the first data packet to the data analytics network element.
  • the user plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic.
  • the user plane function network element may determine whether the traffic corresponding to the first data packet obtained in the period in which the hotspot of the terminal device is enabled is abnormal traffic, thereby accurately identifying abnormal traffic and improving traffic management.
  • the method further includes: sending, by the user plane function network element, a traffic abnormality notification to the terminal device, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic. Therefore, the terminal device may obtain the traffic abnormality notification, and may determine, based on the traffic abnormality notification, that the traffic corresponding to the first data packet is abnormal traffic, so that the terminal device can identify the data packets corresponding to abnormal traffic.
  • the sending, by the user plane function network element, a traffic abnormality notification to the terminal device includes: adding, by the user plane function network element, the traffic abnormality notification to a data message.
  • the user plane function network element may send the traffic abnormality notification to the terminal device by using the data message.
  • a specific frame format of the data message is not limited.
  • the determining, by the user plane function network element, that the traffic corresponding to the first data packet is abnormal traffic includes: receiving, by the user plane function network element, a traffic abnormality notification from the data analytics network element or a control plane network element. Therefore, the user plane function network element, through parsing the traffic abnormality notification, can determine the data packets corresponding to abnormal traffic.
  • the determining, by the user plane function network element, that the traffic corresponding to the first data packet is abnormal traffic includes: receiving, by the user plane function network element, a service type that is from the data analytics network element or the terminal device and that the terminal device allows or does not allow to be used in a period in which the hotspot switch is enabled; receiving, by the user plane function network element, a service type that is from the data analytics network element or the terminal device and that is of the first data packet; and determining, by the user plane function network element based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is the abnormal traffic.
  • the user plane function network element can match the service type of the first data packet by using the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, and can autonomously identify whether the traffic corresponding the first data packet is abnormal traffic.
  • the method further includes: stopping, by the user plane function network element, sending a data packet corresponding to the abnormal traffic, and buffering the data packet corresponding to the abnormal traffic.
  • the user plane function network element stops sending the data packet corresponding to the abnormal traffic, thereby reducing traffic loss of the party enabling the hotspot.
  • the method further includes: receiving, by the user plane function network element, a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and when the user plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is the abnormal traffic, discarding the data packet that corresponds to the abnormal traffic and is buffered by the user plane function network element; or when the user plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not the abnormal traffic, sending the data packet that corresponds to the abnormal traffic and is buffered by the user plane function network element to the terminal device.
  • the user plane function network element When the traffic abnormality answer indicates that the traffic corresponding to the first data packet is not abnormal traffic, the user plane function network element sends the buffered data packet corresponding to the abnormal traffic, so that the party enabling the hotspot can provide traffic for the party using the hotspot.
  • the method further includes: receiving, by the user plane function network element, the traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and sending, by the user plane function network element, the traffic abnormality answer to the data analytics network element.
  • the data analytics network element can update, based on the traffic abnormality answer, information about the service type that the terminal device allows to be used when the Wi-Fi hotspot is enabled, so that during online detection, it can be more accurately identified whether the data packet is abnormal traffic.
  • an embodiment of this application further provides a user plane apparatus that includes: a receiving module, configured to receive hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch is enabled; an obtaining module, configured to: obtain a characteristic parameter of a first data packet, and send the characteristic parameter of the first data packet to a data analytics network element, where the first data packet is data obtained by the user plane apparatus in a period in which the hotspot switch of the terminal device is enabled; and a determining module, configured to determine that traffic corresponding to the first data packet is abnormal traffic.
  • the user plane apparatus further includes a sending module.
  • the sending module is configured to: after the determining module determines that the traffic corresponding to the first data packet is the abnormal traffic, send a traffic abnormality notification to the terminal device, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is the abnormal traffic.
  • the sending module is specifically configured to add the traffic abnormality notification to a data message.
  • the determining module is specifically configured to receive the traffic abnormality notification from the data analytics network element or a control plane network element.
  • the determining module includes: a receiving submodule configured to: receive a service type that is from the data analytics network element or the terminal device and that the terminal device allows or does not allow to be used in a period in which the hotspot switch is enabled, and receive a service type that is from the data analytics network element or the terminal device and that is of the first data packet; and an abnormal traffic determining submodule, configured to determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is the abnormal traffic.
  • the user plane apparatus further includes a traffic buffering module configured to: after the determining module determines that the traffic corresponding to the first data packet is the abnormal traffic, stop sending a data packet corresponding to the abnormal traffic and buffer the data packet corresponding to the abnormal traffic.
  • the user plane apparatus further includes a traffic processing module, where the receiving module is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that there is traffic abnormality or there is no traffic abnormality; and the traffic processing module is configured to: when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is the abnormal traffic, discard the data packet that corresponds to the abnormal traffic and is buffered by the user plane apparatus; or when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not the abnormal traffic, send the data packet that corresponds to the abnormal traffic and is buffered by the user plane apparatus.
  • the receiving module is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that there is traffic abnormality or there is no traffic abnormality
  • the traffic processing module is configured to: when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is the abnormal traffic, discard the data packet that corresponds to
  • the user plane apparatus further includes the sending module, where the receiving module is further configured to receive the traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that there is traffic abnormality or there is no traffic abnormality; and the sending module is configured to send the traffic abnormality answer to the data analytics network element.
  • constituent modules of the user plane apparatus may further perform the steps described in the first aspect and the various possible implementations.
  • constituent modules of the user plane apparatus may further perform the steps described in the first aspect and the various possible implementations.
  • an embodiment of this application provides a traffic processing method, including: sending, by a terminal device, hotspot indication information to a core network network element, where the hotspot indication information includes that a hotspot switch of the terminal device is enabled; and obtaining, by the terminal device, a traffic abnormality notification from the core network network element based on the hotspot indication information.
  • the terminal device needs to send the hotspot indication information to the core network network element, to receive the traffic abnormality notification from the core network network element, so that the terminal device can determine data packets corresponding to abnormal traffic.
  • the method further includes: sending, by the terminal device, to the core network network element, a service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • the terminal device when performing reporting to the core network network element, may add, when sending first-time Wi-Fi hotspot information to the core network network element, the service type that the terminal does not allow or allows to be used in the period in which the Wi-Fi hotspot is enabled.
  • the method further includes: sending, by the terminal device, a traffic abnormality answer to the core network network element, where the traffic abnormality answer includes: there is traffic abnormality or there is no traffic abnormality.
  • the terminal device may use the terminal device to confirm with the core network network element whether there is traffic abnormality, so that the core network network element can perform subsequent traffic management by using the traffic abnormality answer.
  • the method further includes: disabling, by the terminal device based on the traffic abnormality notification, a hotspot of the terminal device; or disabling, by the terminal device, a connection that is of a hotspot user and that generates abnormal traffic; or prohibiting, by the terminal device, a service type generating abnormal traffic from using the hotspot of the terminal device.
  • the core network network element includes at least one of: a control plane function network element, a user plane function network element, a policy network element, and a data analytics network element.
  • an embodiment of this application further provides a traffic processing method.
  • the method includes: obtaining, by a data analytics network element, a service type that a terminal device allows or does not allow to be used in a period in which a wireless fidelity hotspot switch is enabled; receiving, by the data analytics network element, a characteristic parameter of a first data packet from a user plane function network element, where the first data packet is a data packet obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled; determining, by the data analytics network element, a service type of the first data packet based on the characteristic parameter of the first data packet; and determining, by the data analytics network element based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element may determine whether the traffic corresponding to the first data packet obtained in the period in which the hotspot switch of the terminal device is enabled is abnormal traffic, thereby accurately identifying abnormal traffic and improving traffic management.
  • the method further includes: sending, by the data analytics network element, a traffic abnormality notification to a control plane function network element or the user plane function network element, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • the obtaining, by a data analytics network element, a service type that a terminal device allows or does not allow to be used in a period in which a wireless fidelity hotspot switch is enabled includes: determining, by the data analytics network element based on training data, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; or receiving, by the data analytics network element, the service type that is from the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • the method further includes: receiving, by the data analytics network element, a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and updating, by the data analytics network element based on the traffic abnormality answer, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • an embodiment of this application further provides a traffic processing method.
  • the method includes: obtaining, by a data analytics network element, a service type that a terminal device allows or does not allow to be used in a period in which a wireless fidelity hotspot switch is enabled; sending, by the data analytics network element, the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled to a user plane function network element or a control plane function network element; receiving, by the data analytics network element, a characteristic parameter of a first data packet from the user plane function network element, where the first data packet is data obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled; determining, by the data analytics network element, a service type of the first data packet based on the characteristic parameter of the first data packet; and sending, by the data analytics network element, the service type of the first data packet to the user plane function network element or the control plane function network element.
  • the obtaining, by a data analytics network element, a service type that a terminal device allows or does not allow to be used in a period in which a wireless fidelity hotspot switch is enabled includes: determining, by the data analytics network element based on training data, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • an embodiment of this application provides a traffic processing method.
  • the method includes: receiving, by a control plane function network element, hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch is enabled; receiving, by the control plane function network element, a characteristic parameter of a first data packet from a user plane function network element, and sending the characteristic parameter of the first data packet to a data analytics network element, where the first data packet is data obtained by the user plane function network element in a period in which the hotspot switch of the terminal device is enabled; and determining, by the control plane function network element, that traffic corresponding to the first data packet is abnormal traffic.
  • the control plane function network element may determine whether the traffic corresponding to the first data packet obtained in the period in which the hotspot of the terminal device is enabled is abnormal traffic, thereby accurately identifying abnormal traffic and improving traffic management.
  • the method further includes: sending, by the control plane function network element, a traffic abnormality notification to the terminal device, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is the abnormal traffic.
  • the sending, by the control plane function network element, a traffic abnormality notification to the terminal device includes: adding, by the control plane function network element, the traffic abnormality notification to control signaling.
  • the control signaling may use, but is not limited to using, two procedure messages in the following examples. One is a Service Request procedure initiated by a network side, and the traffic abnormality notification is carried in a Paging message for transmission to UE. The other one is a PDU Session Modification procedure initiated by the network side, and the traffic abnormality notification is carried in a PDU Session Modification Accept message for transmission to the UE.
  • the determining, by the control plane function network element, that traffic corresponding to the first data packet is abnormal traffic includes: receiving, by the control plane function network element, the traffic abnormality notification from the data analytics network element or the user plane function network element.
  • the determining, by the control plane function network element, that the traffic corresponding to the first data packet is abnormal traffic includes: receiving, by the control plane function network element, a service type that is from the data analytics network element or the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; receiving, by the control plane function network element, a service type that is from the data analytics network element or the terminal device and that is of the first data packet; and determining, by the control plane function network element based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is the abnormal traffic.
  • the determining, by the control plane function network element, that traffic corresponding to the first data packet is abnormal traffic includes: receiving, by the control plane function network element, a service type that is from the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; receiving, by the control plane function network element, a service type that is from the data analytics network element or the terminal device and that is of the first data packet; and determining, by the control plane function network element based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is the abnormal traffic.
  • the method further includes: instructing, by the control plane function network element, the user plane function network element to stop sending the traffic corresponding to the first data packet, and to buffer the traffic corresponding to the first data packet.
  • the method further includes: receiving, by the control plane function network element, a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and when the control plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic, instructing, by the control plane function network element, the user plane function network element to discard the buffered data packet corresponding to the abnormal traffic; or when the control plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not abnormal traffic, instructing, by the control plane function network element, the user plane function network element to forward the buffered data packet corresponding to the abnormal traffic.
  • the method further includes: receiving, by the control plane function network element, a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that there is traffic abnormality or there is no traffic abnormality; and forwarding, by the control plane function network element, the traffic abnormality answer to the data analytics network element.
  • an embodiment of this application provides a communications apparatus.
  • the communications apparatus may include an entity such as a chip.
  • the communications apparatus includes a processor and a memory.
  • the memory is configured to store an instruction
  • the processor is configured to execute the instruction in the memory, to enable the communications apparatus to perform the method according to any one of the first aspect to the sixth aspect.
  • a terminal device includes a sending module configured to send hotspot indication information to a core network network element, where the hotspot indication information includes that a hotspot switch is enabled, and an obtaining module configured to obtain a traffic abnormality notification from the core network network element based on the hotspot indication information.
  • the sending module is further configured to send, to the core network network element, a service type that the terminal device allows or does not allow to be used in a period in which the hotspot switch is enabled.
  • the terminal device when performing reporting to the core network network element, may add, when sending first-time Wi-Fi hotspot information to the core network network element, the service type that the terminal does not allow or allows to be used in the period in which the Wi-Fi hotspot is enabled.
  • the sending module is further configured to: after the obtaining module obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, send a traffic abnormality answer to the core network network element, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality.
  • the terminal device further includes an abnormality processing module, configured to: after the obtaining module obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, disable a hotspot based on the traffic abnormality notification; or disable a connection that is of a hotspot user and that generates abnormal traffic; or prohibit a service type generating abnormal traffic from using the hotspot.
  • an abnormality processing module configured to: after the obtaining module obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, disable a hotspot based on the traffic abnormality notification; or disable a connection that is of a hotspot user and that generates abnormal traffic; or prohibit a service type generating abnormal traffic from using the hotspot.
  • the core network network element includes at least one of: a control plane function network element, a user plane function network element, a policy network element, and a data analytics network element.
  • an embodiment of this application further provides a data analytics network element.
  • the data analytics network element includes: an obtaining module configured to obtain a service type that a terminal device allows or does not allow to be used in a period in which a wireless fidelity hotspot switch is enabled; a receiving module configured to receive a characteristic parameter of a first data packet from a user plane function network element, where the first data packet is a data packet obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled; a service type determining module configured to determine, based on the characteristic parameter of the first data packet, a service type of the first data packet; and an abnormal traffic determining module configured to determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element further includes: a sending module configured to send, after the abnormal traffic determining module determines that the traffic corresponding to the first data packet is the abnormal traffic, a traffic abnormality notification to a control plane function network element or the user plane function network element, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is the abnormal traffic.
  • the obtaining module is specifically configured to: obtain, based on training data, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; or receive the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled and that is from the terminal device.
  • the receiving module is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and the data analytics network element updates, based on the traffic abnormality answer, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • an embodiment of this application further provides a data analytics network element, including: an obtaining module, configured to obtain a service type that a terminal device allows or does not allow to be used in a period in which a wireless fidelity hotspot switch is enabled; a sending module, configured to send, to a user plane function network element or a control plane function network element, the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled; a receiving module, configured to receive a characteristic parameter of a first data packet from the user plane function network element, where the first data packet is data obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled; a service type determining module, configured to determine, based on the characteristic parameter of the first data packet, a service type of the first data packet; and the sending module further configured to send the service type of the first data packet to the user plane function network element or the control plane function network element.
  • the obtaining module is specifically configured to obtain, based on training data, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • an embodiment of this application provides a control plane function network element, including: a receiving module, configured to receive hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch is enabled; the receiving module, further configured to receive a characteristic parameter of a first data packet from a user plane function network element; a sending module, configured to send the characteristic parameter of the first data packet to a data analytics network element, where the first data packet is data obtained by the user plane function network element in a period in which the hotspot switch of the terminal device is enabled; and an abnormal traffic determining module, configured to determine that traffic corresponding to the first data packet is abnormal traffic.
  • the sending module is further configured to: after the abnormal traffic determining module determines that the traffic corresponding to the first data packet is abnormal traffic, send a traffic abnormality notification to the terminal device, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is the abnormal traffic.
  • the sending module is specifically configured to add the traffic abnormality notification to control signaling.
  • the control signaling may use, but is not limited to using, two procedure messages in the following examples.
  • One is a Service Request procedure initiated by a network side, and the traffic abnormality notification is carried in a Paging message for transmission to UE.
  • the other one is a PDU Session Modification procedure initiated by the network side, and the traffic abnormality notification is carried in a PDU Session Modification Accept message for transmission to the UE.
  • the abnormal traffic determining module is specifically configured to receive the traffic abnormality notification from the data analytics network element or the user plane function network element.
  • the abnormal traffic determining module is specifically configured to: receive a service type that is from the data analytics network element or the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; receive a service type that is from the data analytics network element or the terminal device and that is of the first data packet; and determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the abnormal traffic determining module is specifically configured to: receive the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled and that is from the terminal device; receive the service type that is from the data analytics network element or the terminal device and that is of the first data packet; and determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the sending module is further configured to: after the abnormal traffic determining module determines that the traffic corresponding to the first data packet is abnormal traffic, instruct the user plane function network element to stop sending the traffic corresponding to the first data packet and to buffer the traffic corresponding to the first data packet.
  • the receiving module is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and the sending module is further configured to: when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic, instruct the user plane function network element to discard the buffered data packet corresponding to the abnormal traffic; or when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not abnormal traffic, instruct the user plane function network element to forward the buffered data packet corresponding to the abnormal traffic.
  • the receiving module is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and the control plane function network element forwards the traffic abnormality answer to the data analytics network element.
  • an embodiment of this application provides a terminal device, and the terminal device may include an entity such as a chip.
  • the terminal device includes: a processor and a memory, where the memory is configured to store an instruction, and the processor is configured to execute the instruction in the memory, to enable the terminal device to perform the method according to the foregoing third aspect.
  • an embodiment of this application provides a chip system.
  • the chip system includes a processor, configured to support a network device in implementing a function in the foregoing aspect, for example, sending or processing data and/or information in the foregoing method.
  • the chip system further includes a memory.
  • the memory is configured to store a program instruction and data that are needed by the network device.
  • the chip system may include a chip, or may include a chip and another device.
  • an embodiment of this application provides a computer-readable storage medium.
  • the computer-readable storage medium stores an instruction, and when run on a computer, the instruction enables the computer to perform the methods according to the foregoing aspects.
  • an embodiment of this application provides a computer program product including an instruction, and when run on a computer, the computer program product enables the computer to perform the methods according to the foregoing aspects.
  • FIG. 1 is a schematic architectural diagram of a 5G system according to an embodiment of this application.
  • FIG. 2 is a schematic block flowchart of a traffic processing method according to an embodiment of this application.
  • FIG. 3 is a schematic block flowchart of another traffic processing method according to an embodiment of this application.
  • FIG. 4 is a schematic block flowchart of another traffic processing method according to an embodiment of this application.
  • FIG. 5 is a schematic block flowchart of another traffic processing method according to an embodiment of this application.
  • FIG. 6 is a schematic block flowchart of another traffic processing method according to an embodiment of this application.
  • FIG. 7A and FIG. 7B are schematic flowcharts of interaction among a plurality of network elements in a scenario to which a traffic processing method provided in an embodiment of this application is applied;
  • FIG. 8A , FIG. 8B , and FIG. 8C are schematic flowcharts of interaction among a plurality of network elements in a scenario to which a traffic processing method provided in an embodiment of this application is applied;
  • FIG. 9 is a schematic flowchart of interaction among a plurality of network elements in a scenario to which a traffic processing method provided in an embodiment of this application is applied;
  • FIG. 10 - a is a schematic structural diagram of a user plane apparatus according to an embodiment of this application.
  • FIG. 10 - b is a schematic structural diagram of another user plane apparatus according to an embodiment of this application.
  • FIG. 10 - c is a schematic structural diagram of another user plane apparatus according to an embodiment of this application.
  • FIG. 10 - d is a schematic structural diagram of another user plane apparatus according to an embodiment of this application.
  • FIG. 11 - a is a schematic structural diagram of a terminal device according to an embodiment of this application.
  • FIG. 11 - b is a schematic structural diagram of another terminal device according to an embodiment of this application.
  • FIG. 12 - a is a schematic structural diagram of a data analytics network element according to an embodiment of this application.
  • FIG. 12 - b is a schematic structural diagram of another data analytics network element according to an embodiment of this application.
  • FIG. 13 is a schematic structural diagram of another data analytics network element according to an embodiment of this application.
  • FIG. 14 is a schematic structural diagram of a control plane function network element according to an embodiment of this application.
  • FIG. 16 is a schematic structural diagram of another terminal device according to an embodiment of this application.
  • FIG. 17 is a schematic structural diagram of another data analytics network element according to an embodiment of this application.
  • FIG. 18 is a schematic structural diagram of another control plane function network element according to an embodiment of this application.
  • the terms “first”, “second”, and so on are intended to distinguish between similar objects but do not necessarily indicate a specific order or sequence. It should be understood that the terms used in such a way are interchangeable in certain circumstances, which is merely a determining manner that is used when objects having a same attribute are described in the embodiments of this application.
  • the terms “include”, “contain” and any other variants mean to cover the non-exclusive inclusion, so that a process, method, system, product, or device that includes a series of units is not necessarily limited to those units, but may include other units not expressly listed or inherent to such a process, method, system, product, or device.
  • a and/or B in the embodiments of this application describes only an association relationship between associated objects and represents that three relationships may exist.
  • a and/or B may represent the following cases: Only A exists, both A and B exist, and only B exists.
  • a plurality of means two or more than two.
  • “/” may mean a relationship of “and/or”.
  • the traffic processing method provided in the embodiments of this application may be applied to a third generation (3G) mobile communications system, a fourth generation (4G) mobile communications system, a fifth generation (5G) mobile communications system, or a subsequent evolved communications system.
  • 3G third generation
  • 4G fourth generation
  • 5G fifth generation
  • FIG. 1 is a schematic system architectural diagram of a 5G system to which a traffic processing method provided in an embodiment of this application is applied.
  • An architecture of a 5G system is divided into two parts: an access network and a core network.
  • the access network is used to implement a function related to radio access.
  • the access network includes a radio access network (RAN).
  • the core network may be divided into a user plane and a control plane.
  • the core network user plane includes a user plane function (UPF) network element; and the core network control plane includes a core network access and mobility management function (AMF) network element, a session management function (SMF) network element, a policy control function (PCF) network element, and a network data analytics function (NWDAF) network element.
  • AMF core network access and mobility management function
  • SMF session management function
  • PCF policy control function
  • NWDAF network data analytics function
  • the 5G system may further include: user equipment (UE) and a data network (DN).
  • UE user equipment
  • DN data network
  • UPF user equipment
  • NWDAF NWDAF
  • the AMF network element is mainly responsible for mobility management, such as user location update, registration of a user with a network, and user switching, in a mobile network.
  • the SMF network element is mainly responsible for session management in the mobile network.
  • specific functions of the SMF network element may include: allocating an Internet Protocol (IP) address to a user, selecting the UPF network element that provides a packet forwarding function, and the like.
  • IP Internet Protocol
  • the SMF manages data transmission of the UPF, and is responsible for sending information between the NWDAF and the UPF, including a feature vector, a traffic abnormality result, a data type, and the like.
  • the SMF can complete signaling interaction with an UE, to obtain a hotspot state, for example, to obtain a wireless fidelity Wi-Fi hotspot state, thereby alarming the UE of traffic abnormality.
  • the term RAN refers to a base station.
  • An UE accesses a network through a base station.
  • the UPF network element is mainly responsible for performing traffic processing, such as forwarding and charging, on a message of a user, and is used to transmit data in the network, including service data that is transmitted to the network by a hotspot user through a party enabling the hotspot and that is sent by the hotspot user.
  • the PCF network element is responsible for providing policies, such as a quality of service (QoS) policy and a slice selection policy, to the AMF network element and the SMF network element.
  • QoS quality of service
  • the PCF network element is directly connected to the AMF, the SMF, and the NWDAF.
  • the PCF may determine a service processing policy based on an analysis result of the NWDAF. For example, the PCF determines whether an alarm is initiated by the SMF or the UPF, or whether the alarm is implemented in a manner of 3GPP network signaling or a manner of a data message.
  • the terminal device includes, but is not limited to, user equipment (UE), a subscriber unit, a subscriber station, a mobile station, a mobile, a remote station, a remote terminal device, a mobile terminal device, a user terminal device, a terminal device, a wireless communications device, a user agent, a user apparatus, a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device having a wireless communication function, a computing device, a processing device connected to a wireless modem, an in-vehicle device, a wearable device, a terminal device in an Internet of Things, a household appliance, a virtual reality device, a terminal device in a future 5G network, a terminal device in a future evolved public land mobile network (PLMN), or the like.
  • UE user equipment
  • PLMN public land mobile network
  • a UE establishes a packet data unit (PDU) session between the UE and the RAN, the RAN and the UPF network element, and the UPF network element and the DN, to access the data network.
  • UE1 means user equipment 1 as a party enabling a hotspot.
  • the UE1 is a party enabling a Wi-Fi hotspot, and is connected to the base station through a radio interface.
  • UE2/3/4/5 as a hotspot user, accesses the hotspot of the UE1 in a WLAN manner. Traffic charges produced by traffic used by the UE2/3/4/5 in the network are all counted in a bill of the UE1.
  • the NWDAF network element is responsible for receiving a data feature in the network and performing training to obtain a data model; receiving a data feature reported in real time in the network, and obtaining a service type of current data based on the data model; and obtaining a data service type set allowed or not allowed to be used when the hotspot is enabled. Based on the data service type allowed or not allowed to be used when the hotspot is enabled, determination may be performed with reference to the service type of a real-time data packet. That is, it may be determined whether the current data is abnormal traffic.
  • the NWDAF network element may further deliver information obtained by analysis to another network element (such as the PCF network element, the SMF network element, or the UPF network element), to instruct an operation of the PCF network element, the SMF network element, or the UPF network element.
  • the 5G system provided in the foregoing embodiment includes the control plane network element and the user plane network element.
  • a 4.5G system in which a control plane and a user plane are separated is similar to the 5G system.
  • a control plane network and a user plane of a PGW network element are separated into a PGW-C and a PGW-U.
  • the PGW-C can initiate a bearer modification with bearer QoS update procedure by using control plane signaling.
  • a control plane and a user plane of the SGW network element are separated into an SGW-C and an SGW-U.
  • the SGW-C can initiate the bearer modification with bearer QoS update procedure by using control plane signaling.
  • the PGW-C corresponds to the data control plane function network element, such as the SMF network element, in the 5G system
  • the PGW-U corresponds to the data user plane function network element, such as the UPF network element, in the 5G system.
  • the control plane and the user plane in the 4G system architecture are not separated, and therefore, functions of the control plane and the user plane may be implemented in a same network element, such as the packet data gateway (PGW); or a mobility management entity (MME) corresponds to the control plane network element, and a serving gateway (SGW) corresponds to the user plane network element.
  • PGW packet data gateway
  • MME mobility management entity
  • SGW serving gateway
  • the control plane and the user plane are integrated in the PGW network element, and the PGW network element can be used to manage Wi-Fi hotspot traffic of the terminal device.
  • the PGW network element can send a traffic abnormality notification to the terminal device by using control plane signaling or user plane signaling.
  • the control signaling may be a connection modification procedure or a bearer modification procedure of a packet data network (PDN).
  • PDN packet data network
  • the PGW network element initiates a bearer modification with bearer QoS update procedure.
  • the hotspot is a Wi-Fi hotspot.
  • the manner of using of the Wi-Fi hotspot by other user equipment may be restricted, so that the problem that a traffic abnormality situation cannot be determined timely through a data service that runs through the Wi-Fi hotspot is solved.
  • the network is notified of a current hotspot state, and performs real-time monitoring on the data service in the current state in a manner of big data analysis, so that abnormal traffic determining and alarming for the hotspot of terminal device are implemented.
  • the NWDAF network element obtains a service type that is allowed or not allowed to be used in a period in which the hotspot of the UE is enabled, for example, obtains a list including one or more service types.
  • the service type may be a type identifier (such as a type A service or a type B service).
  • the service type may alternatively be an application identifier.
  • the application identifier may include an APP id, a flow ID, or the like.
  • the service type list may be a list of applications (APP) that the UE allows to be used only when WLAN is enabled.
  • the service type list may include at least one service type.
  • the UE reports a hotspot state (enabled/disabled) of the UE to the network.
  • the UE reports the hotspot state to the SMF network element
  • the SMF network element reports (may indirectly report through a PC network element or directly report through a servitization interface) the hotspot state to the UPF network element and/or the NWDAF network element.
  • the NWDAF network element may collect a feature of a data packet flowing through the UPF network element, and obtain an allowed service type list of each UE in the period in which the hotspot is enabled.
  • the NWDAF network element monitors, in real time, the feature of the data packet flowing through the UPF network element, and obtains the data service type.
  • the NWDAF network element determines abnormal traffic, and sends an abnormal traffic indication to the SMF network element and/or the UPF network element.
  • a determining condition may be that a service type corresponding to the data feature is not in the allowed service type list.
  • the SMF network element and the UPF network element may perform the following operation: The SMF network element or the UPF network element notifies the UE that there is the abnormal traffic behavior of the hotspot. The UE decides a next operation, and the current service continues.
  • the UPF network element obtains detection information (such as IP quintuplets or a UE ID/IP) of the data packet, suspends delivering and buffers the data packet corresponding to the detection information, and stops charging; and in addition, the SMF network element or the UPF network element notifies the UE of the abnormal traffic behavior of the hotspot. If the UE acknowledges the abnormal traffic of the hotspot to the SMF network element and the UPF network element, the UE instructs the UPF network element to discard all data packets corresponding to the detection information (such as the IP quintuplets). Otherwise, the UPF network element continues forwarding the corresponding data packet.
  • detection information such as IP quintuplets or a UE ID/IP
  • the NWDAF network element sends the data service type obtained through analysis to the SMF network element and/or the UPF network element.
  • the SMF network element or the UPF network element determines, based on the allowed/unallowed service type list when the hotspot is enabled obtained from the UE or the NWDAF network element, whether to initiate an alarm to the UE. For example, it may be determined, based on a service type list used only when the WLAN is enabled, whether to initiate the alarm to the UE.
  • a traffic processing method may include the following steps.
  • a user plane function network element receives hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch is enabled.
  • the terminal device is a party enabling the hotspot, for example, a party enabling a Wi-Fi hotspot.
  • the terminal device When a user enables the hotspot switch, the terminal device generates the hotspot indication information.
  • the terminal device may send the hotspot indication information to the user plane function network element through a RAN.
  • the user plane function network element obtains the hotspot indication information and determines that the hotspot switch of the terminal device is enabled.
  • the terminal device may report a state of the hotspot switch to the user plane function network element through a PDU session establishment/PDU session modification/registration/service request procedure. Further, the terminal device may report, to the user plane function network element through the initiated PDU Session Establishment/PDU Session Modification/Registration/Service Request procedure, a service type (list) that the terminal device allows or does not allow to be used in a period in which the hotspot is enabled.
  • a service type list
  • the user plane function network element obtains a characteristic parameter of a first data packet, and sends the characteristic parameter of the first data packet to a data analytics network element, where the first data packet is data obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled.
  • the user plane function network element obtains the data in the period in which the hotspot switch of the terminal device is enabled.
  • Data transmission of the user plane function network element may be divided into uplink transmission and downlink transmission.
  • the uplink transmission may be sending, by the party using the hotspot by using the hotspot provided by the party enabling the hotspot, an uplink data packet to the user plane function network element, and sending, by the user plane function network element, the uplink data packet to a data network.
  • the downlink transmission may be receiving, by the user plane function network element, a downlink data packet from the data network; sending, by the user plane function network element through the RAN, the downlink data packet to the party enabling the hotspot; and sending, by the party enabling the hotspot by using the hotspot, the downlink data packet to the party using the hotspot.
  • the user plane function network element obtains the data packet in the period in which the hotspot switch of the terminal device is enabled. For example, the user plane function network element obtains a first data packet in the period in which the hotspot of the terminal device is enabled, where the first data packet may be an uplink transmitted data packet, or may be a downlink transmitted data packet.
  • the user plane function network element may further obtain a characteristic parameter of the data packet, for example, may obtain a characteristic parameter of the first data packet.
  • the characteristic parameter may include a parameter used to represent a service type of the data packet, such as IP quintuplets, a UE ID/IP, a message length, a filter, a flow identification, or some characteristic parameters obtained based on the data message.
  • the characteristic parameter may include one or more parameters.
  • the characteristic parameter may be presented in a form of a feature vector.
  • the user plane function network element may obtain the characteristic parameter of the first data packet in a manner of feature engineering.
  • the user plane function network element may further send the characteristic parameter of the first data packet to a data analytics network element.
  • the data analytics network element may be the NWDAF network element in the foregoing embodiment.
  • the user plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic.
  • the user plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic.
  • the user plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic. Descriptions are made with examples below.
  • abnormal traffic in this embodiment of this application includes data traffic not allowed in a current state of the terminal device, and whether the traffic is abnormal traffic may be different for each user.
  • a service type A may be normal traffic for UE1, but may be abnormal traffic for UE2.
  • step 203 that the user plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic includes:
  • the user plane function network element may receive the traffic abnormality notification from the data analytics network element or the control plane network element.
  • the user plane function network element obtains the traffic abnormality notification, and may determine, based on the traffic abnormality notification, that the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element may identify the service type of the first data packet by using the characteristic parameter of the first data packet, determine, based on the service type of the first data packet, whether the traffic corresponding to the first data packet is abnormal traffic, and generate the traffic abnormality notification if the traffic corresponding to the first data packet is abnormal traffic.
  • step 203 that the user plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic includes:
  • the user plane function network element determining, by the user plane function network element based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the user plane function network element may obtain the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled, or the user plane function network element may obtain the service type that the terminal device does not allow to be used in the period in which the hotspot switch is enabled.
  • the service type allowed or not allowed to be used may be sent to the user plane function network element by the data analytics network element, or be sent to the user plane function network element by the terminal device.
  • the data analytics network element may identify the service type of the first data packet by using the characteristic parameter of the first data packet, and send the service type of the first data packet to the user plane function network element.
  • the user plane function network element may determine, by using the service type obtained in the foregoing steps, whether the traffic corresponding to the first data packet is abnormal traffic.
  • the traffic processing method provided in this embodiment of this application may further include the following step:
  • the traffic abnormality notification to the terminal device, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • the user plane function network element may further generate the traffic abnormality notification if the traffic corresponding to the first data packet is abnormal traffic.
  • the user plane function network element sends the traffic abnormality notification to the terminal device.
  • the terminal device can obtain the traffic abnormality notification, and can determine, by using the traffic abnormality notification, that the traffic corresponding to the first data packet is abnormal traffic.
  • the sending, by the user plane function network element, the traffic abnormality notification to the terminal device includes:
  • the user plane function network element may send the traffic abnormality notification to the terminal device by using the data message.
  • a specific frame format of the data message is not limited.
  • the user plane function network element sends the traffic abnormality notification to a control plane function network element, so that the traffic abnormality notification may be sent to the terminal device through the control plane function network element.
  • the traffic abnormality notification may be carried in a signaling message (such as a message in a PDU Session Modification procedure initiated by a network side, or a Paging message in a Service Request procedure initiated by the network side).
  • the traffic processing method provided in this embodiment of this application further includes the following step:
  • the user plane function network element may buffer a received data packet based on some detection information corresponding to the first data packet, for example, buffer the data packet based on the IP quintuplets (such as a source IP address/port, a target IP address/port, or a transmission protocol) corresponding to the first data packet.
  • Traffic corresponding to one group of the IP quintuplets may include a plurality of data packets.
  • the user plane function network element stops sending the data packet corresponding to the abnormal traffic, thereby reducing traffic loss of the party enabling the Wi-Fi hotspot.
  • the traffic processing method provided in this embodiment of this application may further include the following steps:
  • the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality;
  • the user plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic, discarding, by the user plane function network element, the data packet that corresponds to the abnormal traffic and is buffered by the user plane function network element;
  • the user plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not abnormal traffic, sending, by the user plane function network element, to the terminal device, the data packet that corresponds to the abnormal traffic and is buffered by the user plane function network element.
  • the terminal device receives the traffic abnormality notification from the user plane function network element.
  • the terminal device may display the traffic abnormality notification to a user, and the user may respond to the traffic abnormality notification. For example, the user may identify whether the traffic is abnormal, and the user may send the traffic abnormality answer to the user plane function network element through the terminal device.
  • the user plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic
  • the user plane function network element discards the buffered data packet corresponding to the abnormal traffic, thereby reducing traffic loss of the party enabling the Wi-Fi hotspot.
  • the user plane function network element When the traffic abnormality answer determines that the traffic corresponding to the first data packet is not abnormal traffic, the user plane function network element sends the buffered data packet corresponding to the abnormal traffic, so that the party enabling the Wi-Fi hotspot can provide traffic for the party using the Wi-Fi hotspot.
  • the traffic processing method provided in this embodiment of this application may further include the following steps:
  • the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality;
  • the terminal device receives the traffic abnormality notification from the user plane function network element.
  • the terminal device may display the traffic abnormality notification to a user, and the user may respond to the traffic abnormality notification. For example, the user may identify whether the traffic is abnormal, and the user may send the traffic abnormality answer to the user plane function network element through the terminal device.
  • the user plane function network element may further send the traffic abnormality answer to the data analytics network element, and the data analytics network element may determine, based on the traffic abnormality answer, whether there is traffic abnormality.
  • the data analytics network element can update, based on the traffic abnormality answer, information about the service type that the terminal device allows to be used when the Wi-Fi hotspot is enabled, so that during online detection, it can be more accurately identified whether the data packet is abnormal traffic.
  • the foregoing embodiment describes the traffic processing method provided in the embodiments of this application from the perspective of the user plane function network element.
  • the traffic processing method provided in the embodiments of this application is described from the side of a terminal device below. Referring to FIG. 3 , the traffic processing method provided in the embodiments of this application may include the following steps.
  • a terminal device sends hotspot indication information to a core network network element, where the hotspot indication information includes that a hotspot switch of the terminal device is enabled.
  • the terminal device is a party enabling the hotspot.
  • the terminal device may be a party enabling a Wi-Fi hotspot.
  • the terminal device When a user enables the hotspot switch, the terminal device generates the hotspot indication information.
  • the terminal device may send the hotspot indication information to a user plane function network element through a RAN.
  • the traffic processing method according to this embodiment of this application may further include the following step:
  • the service type not allowed or allowed to be used in the period in which the Wi-Fi hotspot is enabled may also be content in the hotspot indication information, so that the hotspot indication information sent to the core network network element by the terminal device, in addition to including the notification that the hotspot switch is enabled, further includes information about the service type not allowed or allowed to be used in the period in which the Wi-Fi hotspot is enabled.
  • the core network network element may include one of: a control plane function network element, the user plane function network element, a policy network element, and a data analytics network element.
  • the control plane function network element and the user plane function network element may be specifically PGW network elements.
  • the control plane function network element may be specifically an SMF network element
  • the user plane function network element may be specifically a UPF network element
  • the data analytics network element may be specifically the foregoing NWDAF network element.
  • the terminal device obtains a traffic abnormality notification from the core network network element based on the hotspot indication information.
  • the core network network element may determine that the traffic corresponding to a first data packet is abnormal traffic, and then the core network network element may send the traffic abnormality notification to the terminal device.
  • the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • the traffic processing method provided in this embodiment of this application may further include the following step:
  • the terminal device sending, by the terminal device, a traffic abnormality answer to the core network network element, where the traffic abnormality answer includes: there is traffic abnormality or there is no traffic abnormality.
  • the terminal device receives the traffic abnormality notification from the user plane function network element.
  • the terminal device may display the traffic abnormality notification to a user, and the user may respond to the traffic abnormality notification. For example, the user may identify whether the traffic is abnormal, and the user may send the traffic abnormality answer to the core network network element through the terminal device.
  • the core network network element may determine, based on the traffic abnormality answer, whether there is traffic abnormality.
  • the core network network element can update, based on the traffic abnormality answer, the service type that the terminal device allows to be used when the Wi-Fi hotspot is enabled, so that during online detection, it can be more accurately identified whether there is abnormal traffic.
  • the traffic processing method provided in this embodiment of this application may further include the following steps:
  • Processing after the terminal device receives traffic abnormality information is not limited in this embodiment of this application. For example, after it is determined that there is abnormal traffic, the Wi-Fi hotspot may be disabled, or it may be determined that a Wi-Fi hotspot user disables a connection of the user, or a service type is temporarily banned. A specific implementation is not limited herein.
  • the terminal device sends the hotspot indication information to the core network network element, and the terminal device obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, so that the terminal device may determine, based on the traffic abnormality notification, data packets corresponding to abnormal traffic.
  • the foregoing embodiment describes the traffic processing method according to the embodiments of this application from the perspective of the terminal device.
  • the traffic processing method according to the embodiments of this application is described from the side of a data analytics network element below.
  • the traffic processing method according to the embodiments of this application may include the following steps.
  • a data analytics network element obtains a service type that a terminal device allows or does not allow to be used in a period in which a hotspot switch is enabled.
  • the data analytics network element may be specifically the foregoing NWDAF network element.
  • the data analytics network element first obtains the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled, or the data analytics network element obtains the service type that the terminal device does not allow to be used in the period in which the hotspot switch is enabled.
  • the data analytics network element may obtain the service type in a manner of big data analysis, or the data analytics network element may obtain the service type through the terminal device.
  • step 401 that the data analytics network element obtains the service type that the terminal device allows or does not allow to be used in the period in which the wireless fidelity hotspot switch is enabled includes:
  • the data analytics network element receiving, by the data analytics network element, the service type that is from the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • the data analytics network element obtains the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled:
  • the UE sends an allowed or disallowed service type list to the data analytics network element, or the data analytics network element performs machine learning training, to obtain a service type identification model.
  • the training data used for machine learning may include two types of data.
  • One type is application data including a size, a start time and an end time, IP quintuplets, and a service type that are of a data packet, from an operator platform, an OTT (Over The Top) server, a vertical industry management and control center, or the like.
  • Another type is network data including a UE identifier, a terminal type, an access point name (APN), a data network name (DNN), radio channel quality on a base station side, a cell ID, and other information from a network side.
  • the data analytics network element may obtain the service type identification model based on the two types of information, and can classify a data packet of the UE that flows through the UPF network element, thereby obtaining the service type that the UE allows to be used in the period in which the Wi-Fi hotspot of the UE is enabled.
  • the data analytics network element receives a characteristic parameter of a first data packet from the user plane function network element, where the first data packet is a data packet obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled.
  • the characteristic parameter includes a parameter used to represent a service type of a data packet.
  • the characteristic parameter may be a feature vector.
  • the user plane function network element may specifically obtain the characteristic parameter of the first data packet in a manner of feature engineering.
  • the user plane function network element may further send the characteristic parameter of the first data packet to the data analytics network element.
  • the user plane function network element sends the characteristic parameter of the first data packet to an SMF network element
  • the SMF network element sends the characteristic parameter of the first data packet to a PCF network element
  • the PCF network element sends the characteristic parameter of the first data packet to the NWDAF network element.
  • the NWDAF network element may receive the characteristic parameter of the first data packet from the user plane function network element.
  • the data analytics network element determines a service type of the first data packet based on the characteristic parameter of the first data packet.
  • the data analytics network element may determine the service type of the first data packet through the service type identification model. For example, the data analytics network element may obtain a feature list of the service type identification model through feature learning, thereby obtaining a model parameter of the service type identification model through training, and performing calculation based on the characteristic parameter of the first data packet and the service identification model, so that the service type of the first data packet may be determined.
  • the data analytics network element determines, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element may determine the service type of the first data packet through step 403 , and match the service type of the first data packet and the service type that is obtained in step 401 and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, thereby determining that the traffic corresponding to the first data packet is abnormal traffic. For example, the data analytics network element obtains the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled. If the service type of the first data packet is not the service type allowed to be used, it may be determined that the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element obtains the service type that the terminal device does not allow to be used in the period in which the hotspot switch is enabled. If the service type of the first data packet is the service type not allowed to be used, it may be determined that the traffic corresponding to the first data packet is abnormal traffic.
  • the traffic processing method according to this embodiment of this application may further include the following step:
  • a traffic abnormality notification to a control plane function network element or the user plane function network element, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element may determine that the traffic corresponding to the first data packet is abnormal traffic, and then the data analytics network element may send the traffic abnormality notification to the control plane function network element or the user plane function network element. After the control plane function network element or the user plane function network element receives the traffic abnormality notification, the control plane function network element or the user plane function network element sends the traffic abnormality notification, and may further forward the traffic abnormality notification to the terminal device.
  • the control plane function network element or the user plane function network element sends the traffic abnormality notification, and may further forward the traffic abnormality notification to the terminal device.
  • the traffic processing method according to this embodiment of this application may further include the following steps:
  • the data analytics network element receives, by the data analytics network element, a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality;
  • the terminal device receives the traffic abnormality notification from the user plane function network element.
  • the terminal device may display the traffic abnormality notification to a user, and the user may respond to the traffic abnormality notification. For example, the user may identify whether the traffic is abnormal, and the user may send the traffic abnormality answer to the user plane function network element through the terminal device.
  • the user plane function network element may further send the traffic abnormality answer to the data analytics network element, and the data analytics network element may determine, based on the traffic abnormality answer, whether there is traffic abnormality.
  • the data analytics network element can update, based on the traffic abnormality answer, the service type that is allowed to be used in the period in which the hotspot is enabled, so that it can be more accurately identified whether the data packet is abnormal traffic.
  • the data analytics network element obtains the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; the data analytics network element receives the characteristic parameter of the first data packet from the user plane function network element, where the first data packet is a data packet obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled; the data analytics network element determines the service type of the first data packet based on the characteristic parameter of the first data packet; and the data analytics network element determines, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element may obtain the service type of the first data packet from the user plane function network element, and may determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic, thereby accurately identifying the abnormal traffic and improving traffic management.
  • the foregoing embodiment describes a traffic processing method according to the embodiments of this application from the perspective of the data analytics network element. Another traffic processing method according to the embodiments of this application is described from the side of a data analytics network element below.
  • the traffic processing method according to the embodiments of this application may include the following steps.
  • a data analytics network element obtains a service type that a terminal device allows or does not allow to be used in a period in which a hotspot switch is enabled.
  • the data analytics network element may be specifically the foregoing NWDAF network element.
  • the data analytics network element first obtains the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled, or the data analytics network element obtains the service type that the terminal device does not allow to be used in the period in which the hotspot switch is enabled.
  • the data analytics network element may obtain the service type in a manner of feature engineering, or the data analytics network element may obtain the service type through the terminal device.
  • step 501 that the data analytics network element obtains the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled includes:
  • the data analytics network element determining, by the data analytics network element based on training data, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • the data analytics network element sends, to a user plane function network element or a control plane function network element, the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled.
  • the data analytics network element may send, to the user plane function network element or the control plane function network element, the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled, so that the user plane function network element or the control plane function network element can determine the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled.
  • the data analytics network element receives a characteristic parameter of a first data packet from the user plane function network element, where the first data packet is data obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled.
  • the characteristic parameter is a parameter used to represent a service type of a data packet.
  • the characteristic parameter may be a feature vector
  • the user plane function network element may specifically obtain the characteristic parameter of the first data packet through calculation in a manner of feature engineering.
  • the user plane function network element may further send the characteristic parameter of the first data packet to the data analytics network element.
  • the user plane function network element sends the characteristic parameter of the first data packet to an SMF network element
  • the SMF network element sends the characteristic parameter of the first data packet to a PCF network element
  • the PCF network element sends the characteristic parameter of the first data packet to the NWDAF network element.
  • the NWDAF network element may receive the characteristic parameter of the first data packet from the user plane function network element.
  • the data analytics network element determines a service type of the first data packet based on the characteristic parameter of the first data packet.
  • the data analytics network element may determine the service type of the first data packet through the service type identification model. For example, the data analytics network element may obtain a feature list of the service type identification model through feature learning, thereby obtaining a model parameter of the service type identification model through training, and performing calculation based on the characteristic parameter of the first data packet and the service identification model, so that the service type of the first data packet may be determined.
  • the data analytics network element sends the service type of the first data packet to the user plane function network element or the control plane function network element.
  • the data analytics network element after the data analytics network element determines the service type of the first data packet, the data analytics network element sends the service type of the first data packet to the user plane function network element or the control plane function network element, so that the user plane function network element or the control plane function network element can perform matching based on the service type of the first data packet and the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled, and the user plane function network element or the control plane function network element can autonomously determine whether the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element can be used for determining the service type of the first data packet, but the data analytics network element does not determine a traffic abnormality situation. Instead, the user plane function network element or the control plane function network element can autonomously determine whether the traffic corresponding to the first data packet is abnormal traffic.
  • the foregoing embodiment describes a traffic processing method according to the embodiments of this application from the perspective of the data analytics network element.
  • the traffic processing method according to the embodiments of this application is described from the side of a control plane function network element below.
  • the traffic processing method according to the embodiments of this application may include the following steps.
  • a control plane function network element receives hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch is enabled.
  • the control plane function network element may be an SMF network element in a 5G system.
  • the terminal device is a party enabling the Wi-Fi hotspot.
  • the terminal device When a user enables the hotspot switch, the terminal device generates the hotspot indication information.
  • the terminal device may send the hotspot indication information to a user plane function network element through a RAN, the user plane function network element forwards the hotspot indication information to the control plane function network element, and the control plane function network element parses the hotspot indication information and determines that the hotspot switch of the terminal device is enabled.
  • the control plane function network element receives a characteristic parameter of a first data packet from the user plane function network element, and sends the characteristic parameter of the first data packet to a data analytics network element, where the first data packet is data obtained by the user plane function network element in a period in which the hotspot switch of the terminal device is enabled.
  • the user plane function network element transmits the data in the period in which the hotspot switch of the terminal device is enabled.
  • Data transmission of the user plane function network element may be divided into uplink transmission and downlink transmission.
  • the user plane function network element may further obtain a characteristic parameter of the data packet, for example, may obtain a characteristic parameter of the first data packet.
  • the user plane function network element sends the characteristic parameter of the first data packet to the control plane function network element, and the control plane function network element may further forward the characteristic parameter of the first data packet to the data analytics network element.
  • the control plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic.
  • the control plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic.
  • the control plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic. Descriptions are made with examples below.
  • the traffic processing method further includes:
  • the control plane function network element may send the traffic abnormality notification to the terminal device.
  • the terminal device may parse the traffic abnormality notification, and may determine, based on the traffic abnormality notification, that the traffic corresponding to the first data packet is abnormal traffic.
  • the sending, by the control plane function network element, the traffic abnormality notification to the terminal device includes:
  • the control plane function network element may send the traffic abnormality notification to the terminal device using control signaling.
  • a specific message of the control signaling is not limited.
  • step 603 that the control plane function network element determines that traffic corresponding to the first data packet is abnormal traffic includes:
  • control plane function network element receiving, by the control plane function network element, the traffic abnormality notification from the data analytics network element or the user plane function network element.
  • the control plane function network element may receive the traffic abnormality notification from the data analytics network element or the user plane network element.
  • the control plane function network element parses the traffic abnormality notification, and may determine, based on the traffic abnormality notification, that the traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element may identify the service type of the first data packet by using the characteristic parameter of the first data packet, determine, based on the service type of the first data packet, whether the traffic corresponding to the first data packet is abnormal traffic, and generate the traffic abnormality notification if the traffic corresponding to the first data packet is abnormal traffic.
  • step 603 that the control plane function network element determines that traffic corresponding to the first data packet is abnormal traffic includes:
  • control plane function network element receiving, by the control plane function network element, a service type that is from the data analytics network element or the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled;
  • the control plane function network element determining, by the control plane function network element based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the control plane function network element may obtain the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled, or the control plane function network element may obtain the service type that the terminal device does not allow to be used in the period in which the hotspot switch is enabled.
  • the service type may be sent to the control plane function network element by the data analytics network element, or be sent to the control plane function network element by the terminal device.
  • the data analytics network element may identify the service type of the first data packet by using the characteristic parameter of the first data packet, and send the service type of the first data packet to the control plane function network element.
  • the control plane function network element may determine, by using the service type obtained in the foregoing steps, whether the traffic corresponding to the first data packet is abnormal traffic.
  • the traffic processing method further includes:
  • the control plane function network element determines that the traffic corresponding to the first data packet is abnormal traffic
  • the control plane function network element instructs that the user plane function network element may perform buffering based on data packets of IP quintuplets corresponding to the first data packet. Traffic corresponding to one group of the IP quintuplets may include a plurality of data packets.
  • the user plane function network element stops sending the data packet corresponding to the abnormal traffic, thereby reducing traffic loss of the party enabling the Wi-Fi hotspot.
  • the traffic processing method according to this embodiment of this application further includes:
  • the control plane function network element receiving, by the control plane function network element, a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality;
  • control plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic, instructing, by the control plane function network element, the user plane function network element to discard the buffered data packet corresponding to the abnormal traffic;
  • control plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not abnormal traffic, instructing, by the control plane function network element, the user plane function network element to forward the buffered data packet corresponding to the abnormal traffic.
  • the terminal device receives the traffic abnormality notification from the user plane function network element.
  • the terminal device may display the traffic abnormality notification to a user, and the user may respond to the traffic abnormality notification. For example, the user may identify whether the traffic is abnormal, and the user may send the traffic abnormality answer to the control plane function network element through the terminal device.
  • the control plane function network element determines, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic
  • the control plane function network element instructs the user plane function network element to discard the buffered data packet corresponding to the abnormal traffic, thereby reducing traffic loss of the party enabling the Wi-Fi hotspot.
  • the control plane function network element instructs the user plane function network element to send the buffered data packet corresponding to the abnormal traffic, so that the party enabling the Wi-Fi hotspot can provide traffic for the party using the Wi-Fi hotspot.
  • the traffic processing method according to this embodiment of this application further includes:
  • the control plane function network element receiving, by the control plane function network element, a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality;
  • the terminal device receives the traffic abnormality notification from the control plane function network element.
  • the terminal device may display the traffic abnormality notification to a user, and the user may respond to the traffic abnormality notification. For example, the user may identify whether the traffic is abnormal, and the user may send the traffic abnormality answer to the control plane function network element through the terminal device.
  • the control plane function network element may further send the traffic abnormality answer to the data analytics network element, and the data analytics network element may determine, based on the traffic abnormality answer, whether there is traffic abnormality.
  • the data analytics network element can update, based on the traffic abnormality answer, the service type that is allowed to be used in the period in which the hotspot switch is enabled, so that the service type of the data packet can be more accurately identified, to provide the accurate service type to analysis of the abnormal traffic.
  • the control plane function network element may obtain the service type of the first data packet from the user plane function network element, and may determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic, thereby accurately identifying abnormal traffic and improving traffic management.
  • FIG. 7A and FIG. 7B are schematic flowcharts of UE Hotspot Off enabled/disabled state interaction among a plurality of network elements in a 5G system. Description is made by using an example in which an interaction procedure is a PDU Session Establishment/Modification procedure initiated by the UE. The procedure may alternatively be a Service Request/Registration procedure initiated by the UE. Details are not described herein again. The following steps are mainly included:
  • UE sends a session management request message to an SMF network element.
  • the UE functions as a party enabling a Wi-Fi hotspot, and the UE reports a UE Hotspot Off enabled/disabled state or an enabled/disabled state of another specific mode to a network.
  • the UE also reports, to the network, a service type not allowed to be used in a period in which the UE Hotspot Off is enabled.
  • An example of the enabled state of the hotspot is used in subsequent descriptions.
  • hotspot state information is notified to the SMF network element, and may be carried in the session management request message (PDU session establishment/modification request) through RAN-AMF-SMF. Names of the message in each state are different, but all are for session establishment or modification.
  • the SMF network element sends the session management request message to a UPF network element.
  • the SMF notifies the UPF network element of the hotspot state information, and the hotspot state information may be carried in the session management request message (N4 session establishment/modification request).
  • the SMF network element and the UPF network element both obtain the current hotspot state information of the UE.
  • the UPF network element reports, to an NWDAF network element, a data feature of a data packet of the UE in the period in which the hotspot is enabled.
  • the NWDAF network element functions as a network element determining data traffic abnormality. For the service data packet in the period in which the Hotspot is enabled, the NWDAF network element collects the data feature, such as a UE ID/IP, a time/period, a data packet size/quantity, or an extended field, as training data.
  • the data feature such as a UE ID/IP, a time/period, a data packet size/quantity, or an extended field, as training data.
  • the NWDAF network element obtains, through big data analysis, an allowed or disallowed service type list of the UE in the period in which the hotspot is enabled.
  • the NWDAF network element For each UE, the NWDAF network element performs big data analysis, assumes a behavior or a model of service type determination, obtains, by learning, a feature list of the service type determining model, and synchronizes the feature list corresponding to the model to feature engineering on the NWDAF network element and the UPF network element.
  • the feature list in a feature vector may be understood as a parameter name.
  • the feature vector reported to the NWDAF network element by the UPF network element is a parameter value.
  • the NWDAF network element obtains, through training, the allowed (or unallowed) service type list of the UE in a specific state (the hotspot enabled state).
  • the UPF network element determines that the hotspot of the UE is currently enabled, collects a real-time data packet, and obtains, through calculation, a feature vector corresponding to the service type determining model.
  • the UPF network element receives a new data packet, and calculates a feature vector based on the local feature engineering.
  • the UPF network element sends an abnormal traffic detection request to the NWDAF network element.
  • the UPF network element reports, through the SMF network element and the PCF network element, the feature vector obtained through calculation to the NWDAF network element, and requests the NWDAF network element to discriminate a data service type.
  • the NWDAF network element obtains the service type based on the feature vector, determines whether a service corresponding to the data packet is in the allowed service type list, and if the service corresponding to the data packet is not in the allowed service type list, determines that the data packet is abnormal traffic of the Wi-Fi hotspot.
  • the NWDAF network element obtains the service type of the current data based on the feature vector, and compares the service type with the service type list obtained through training in the foregoing steps, to determine whether the service data flow corresponding to the current data packet is abnormal traffic.
  • the NWDAF network element sends a Wi-Fi hotspot abnormal traffic indication to the UPF network element.
  • the abnormal traffic indication is forwarded to the SMF network element and the UPF network element by the PCF network element.
  • the PCF network element can decide to send an indication to the SMF network element or the UPF network element. For example, if a policy in the PCF network element requires notifying, in a manner of control signaling, the UE of the abnormal traffic indication information in the enabled state of the Wi-Fi hotspot, the PCF network element may instruct the SMF network element to perform the notifying in a manner A or a manner B. Certainly, if there is originally only one policy, a problem of policy selection does not exist, but it is necessary to learn from the PCF network element which policy is to be used.
  • An implementable manner A includes:
  • the SMF learns from the NWDAF that there is an abnormal traffic behavior of the Wi-Fi hotspot in the period in which the hotspot is enabled, and decides to alarm the UE.
  • the Wi-Fi hotspot abnormal traffic indication is not limited to.
  • the SMF network element after receiving the abnormal traffic indication delivered by the NWDAF network element, determines that there is suspected data packet abnormality on the current UE, and alarms the UE.
  • the SMF network element initiates an alarm carrying the abnormal traffic indication to the UE.
  • An implementable manner B includes:
  • the SMF learns from the NWDAF that there is an abnormal traffic behavior of the Wi-Fi hotspot in the period in which the hotspot is enabled, and decides to alarm the UE.
  • the Wi-Fi hotspot abnormal traffic indication is the Wi-Fi hotspot abnormal traffic indication.
  • the UPF network element after receiving the abnormal traffic indication delivered by the NWDAF network element, learns that there is suspected data packet abnormality on the current UE, and alarms the UE.
  • the UPF network element initiates an alarm carrying the abnormal traffic indication to the UE.
  • the UPF network element may send a specific data packet of the abnormal traffic indication, and adds the abnormal traffic indication information to a header of the data packet.
  • a message includes an abnormal traffic indication field, or the abnormal traffic indication information is added to an extended field except a standard field.
  • the UE after receiving the message, can obtain the abnormal traffic indication information in the header.
  • the message may be a message independent of the current service data, or may be a data message of the current service.
  • processing after the UE receives the abnormal traffic indication information is not limited, and may include determining the abnormality and disabling the Wi-Fi hotspot, determining a party using the Wi-Fi hotspot and disabling a connection of the user, temporarily prohibiting a service type, or the like.
  • the NWDAF network element can monitor, in real time, a service condition of the party enabling the Wi-Fi hotspot; obtain the service type of the data by analyzing the data feature; determine, based on the allowed/unallowed service type list in the current state obtained through training, whether the current service is abnormal traffic; and send the determining result of the NWDAF network element to a data forwarding control network element and a data forwarding network element that decide to send the abnormal traffic indication to the UE.
  • the UE decides a subsequent operation.
  • this embodiment of this application gets rid of manual configuration, or adds a manner of network analysis and indication based on the existing manual configuration.
  • a data analytics network element in the network obtains a service type by analyzing a data service; determines, by comparing the service type with the allowed/unallowed service type list in the current state obtained through training, whether data of the service type is abnormal traffic in the current state; and sends the abnormal traffic indication to a network element (such as the SMF network element or the UPF network element) related to data processing in the network.
  • the network element related to data processing sends the abnormal traffic indication to the UE.
  • FIG. 8A , FIG. 8B , and FIG. 8C another procedure of interaction among a plurality of network elements in a 5G system provided in an embodiment of this application is described below, and includes the following process:
  • UE sends a session management request message to an SMF network element.
  • the SMF network element sends the session management request message to a UPF network element.
  • the UPF network element reports, to an NWDAF network element, a data feature of a data packet of the UE in a period in which a hotspot is enabled.
  • the NWDAF network element obtains, through big data analysis, an allowed or unallowed service type list the UE in the period in which the hotspot is enabled.
  • the UPF network element determines that the hotspot of the UE is currently enabled, collects a real-time data packet, and obtains, through calculation, a feature vector corresponding to a service type determining model.
  • the UPF network element sends an abnormal traffic detection request to the NWDAF network element.
  • the NWDAF network element obtains the service type based on the feature vector, determines whether a service corresponding to the data packet is in the allowed service type list, and if the service corresponding to the data packet is not in the allowed service type list, determines that the data packet is abnormal traffic of the Wi-Fi hotspot.
  • the NWDAF network element sends a Wi-Fi hotspot abnormal traffic indication to the UPF network element.
  • Step 801 to step 808 are the same as step 701 to step 708 in the processing procedure related to the NWDAF in the embodiment shown in FIG. 7A and FIG. 7B .
  • step 808 there may be the following two implementations: manner A and manner B.
  • Manner A manner of control signaling includes step 809 to step 814 .
  • the UPF network element suspends delivering and buffers a data packet.
  • the UPF network element sends the Wi-Fi hotspot abnormality indication to the SMF network element.
  • the SMF network element suspends delivering and buffers a data packet.
  • the SMF network element sends the Wi-Fi hotspot abnormal traffic indication to the UE.
  • the UE indicates to the SMF network element whether the data packet is abnormal traffic.
  • the SMF network element sends Wi-Fi hotspot abnormality acknowledgment information to the UPF network element.
  • the UPF network element after receiving the abnormal traffic indication information delivered by the NWDAF network element, in addition to deciding to initiate the alarm to the UE, further suspends delivering and buffers the current service data. Because in this embodiment, the UPF network element, after receiving the abnormal traffic indication information from the NWDAF network element, needs to perform control on the service data, the UPF network element suspends delivering and buffers the service data. If the UPF network element decides to whether to initiate the alarm, the UPF network element further needs to instruct the SMF network element to send the abnormal traffic indication information to the UE.
  • the SMF network element after receiving the abnormal traffic indication information from the NWDAF network element, sends an alarm to the UE
  • the UPF network element after receiving the abnormal traffic indication information from the NWDAF network element, suspends delivering and buffers the data.
  • the UE feeds back abnormal traffic acknowledgment information through a signaling message with a Yes/No result.
  • Manner B A manner of a data message includes the following step 815 to step 818 .
  • the UPF learns from the NWDAF that there is an abnormal traffic behavior of the Wi-Fi hotspot in the period in which the hotspot is enabled, and the UPF suspends delivering and buffers the data packet of the service, and decides to alarm the UE.
  • the UPF network element sends the Wi-Fi hotspot abnormal traffic indication to the UE.
  • the UE sends to the UPF network element whether the data packet is abnormal traffic.
  • the UPF network element sends to the SMF network element whether the data packet is abnormal traffic.
  • the UPF network element after receiving the abnormal traffic indication information delivered by the NWDAF network element, in addition to deciding to initiate the alarm to the UE, further suspends delivering and buffers the current service data.
  • the UE feeds back the abnormal traffic acknowledgment information in a data message manner with a Yes/No result.
  • the UPF network element needs to report the acknowledgment information to the SMF network element.
  • the UPF network element determines, based on the feedback result of the UE, that the current data packet is not abnormal, and delivers the buffered data packet. If the UE feeds back that the currently alarmed service is not abnormal traffic, the buffered data is delivered.
  • the UPF network element determines, based on the feedback result of the UE, that the current data packet is abnormal, and discards all data packets corresponding to the IP quintuplets.
  • the UPF network element discards the buffered service data.
  • the SMF network element sends to the NWDAF network element whether the data packet is abnormal traffic.
  • the NWDAF network element performs abnormal traffic determination and correction, and updates an allowed service list.
  • the UPF network element/SMF network element After the UPF network element/SMF network element receives the feedback of the UE, the UPF network element/SMF network element feeds back to the NWDAF network element in a reporting manner that the current service type is not abnormal traffic for the UE, to correct an abnormal traffic determining condition of the NWDAF network element.
  • a most direct manner is to add the service type to the type list allowed in the period in which the hotspot is enabled, or to add a feature and a classification result of the service, as training data, to an algorithm for determining a service type, to update a feature list.
  • processing on the data message after the UPF network element receives the abnormal traffic indication information of the NWDAF network element is added, and the abnormal traffic determination by the NWDAF network element and the acknowledgment of the abnormal traffic indication by the UE can be inspected at the same time, thereby avoiding a problem caused by inaccurate abnormal traffic determination by the NWDAF network element.
  • the NWDAF network element updates and corrects a service type determining model or the service type list allowed/unallowed in the state.
  • This embodiment differs from the embodiment shown in FIG. 7A and FIG. 7B in that, the SMF network element/UPF network element does not determine, only based on the indication information of the NWDAF network element, that the current data service is abnormal; and when the NWDAF network element delivers the abnormality indication, the indication information is sent to the UE, and an acknowledgment message of the UE is used as the final result.
  • the UPF network element suspends delivering and buffers the service data, and decides, after receiving the acknowledgment information, to continue forwarding or discard the service data.
  • the SMF/UPF reports the acknowledgment information of the UE to the NWDAF network element, so that the NWDAF network element corrects the abnormal traffic determining and updates the service list.
  • FIG. 9 is another procedure of interaction among a plurality of network elements in a 5G system provided in an embodiment of this application, and the following steps are included:
  • UE sends, to an SMF network element, a service type list supported when a Wi-Fi hotspot is enabled.
  • the SMF network element sends, to a UPF network element, the service type list supported when the Wi-Fi hotspot is enabled.
  • the UE sends a hotspot state and a service type list allowed or disallowed to be run in the state to a network. For example, a service type list supported to be run only when a WLAN is enabled is sent to the network, or a service type list not supported when the WLAN is enabled is sent to the network.
  • the allowed service type list is optional. If the SMF network element determines whether there is abnormal traffic, the service type list information does not need to be sent to the UPF network element. If the UPF network element determines whether there is abnormal traffic, the service type list needs to be sent to the UPF network element.
  • the state and the list are not required to be sent in a same message. The state and the list may be sent in a session modification procedure when a user enables the hotspot, but the allowed service list in a hotspot enabled state may be sent, as a capability of the UE, to the network in a session establishment procedure.
  • the UPF network element determines that the hotspot of the UE is currently enabled, collects a real-time data packet, and obtains, through calculation, a feature vector corresponding to a service type determining model.
  • the UPF network element reports the feature vector of the data to an NWDAF network element.
  • the UPF network element sends a service type request to the NWDAF network element.
  • the NWDAF network element obtains a service type based on the feature vector.
  • the NWDAF network element obtains, through analysis based on the feature vector reported by the UPF network element, the service type of the data.
  • the NWDAF network element sends a service type response to the UPF network element.
  • the NWDAF network element sends an analysis result to the SMF network element or the UPF network element.
  • the UPF network element learns, from the NWDAF network element, of the service type of the real-time data packet in the period in which the hotspot is enabled, determines that the service type is not in the service type list supported to be run when the Wi-Fi hotspot is enabled, and decides to alarm the UE.
  • the UE is notified, in a control signaling manner, that currently there is abnormal traffic. This is similar to the manner A in the embodiment shown in FIG. 8A , FIG. 8B , and FIG. 8C .
  • the UE is notified, in a data message manner, that currently there is abnormal traffic. This is similar to the manner B in the embodiment shown in FIG. 8A , FIG. 8B , and FIG. 8C .
  • the network-side network elements related to data processing learn of the service type list allowed/unallowed in a specific state (the Wi-Fi hotspot enabled state, or the like), and the NWDAF network element analyzes the service type of the current data and feeds back to the network elements related to data processing, thereby determining whether the current service data is abnormal traffic, and sending an abnormal traffic indication to the UE, so that the UE may perform further processing.
  • a specific state the Wi-Fi hotspot enabled state, or the like
  • This embodiment differs from the embodiment shown in FIG. 7A and FIG. 7B in that, the UE sends the service type list allowed in a Wi-Fi hotspot enabled state to the network (such as the SMF network element/UPF network element receive) in advance; after receiving the service type information of the current data obtained by the NWDAF network element through analysis, the SMF or the UPF can determine whether the current data service is abnormal traffic; and if the current data service is abnormal traffic, the UE is alarmed.
  • the network such as the SMF network element/UPF network element receive
  • a user plane apparatus 1000 provided in an embodiment of this application may include: a receiving module 1001 , an obtaining module 1002 , and a determining module 1003 .
  • the receiving module 1001 is configured to receive hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch is enabled.
  • the obtaining module 1002 is configured to: obtain a characteristic parameter of a first data packet, and send a characteristic parameter of the first data packet to a data analytics network element, where the first data packet is the data obtained by the user plane apparatus in a period in which the hotspot switch of the terminal device is enabled.
  • the determining module 1003 is configured to determine that traffic corresponding to the first data packet is abnormal traffic.
  • the user plane apparatus 1000 further includes: a sending module 1004 .
  • the sending module 1004 is configured to: after the determining module 1003 determines that the traffic corresponding to the first data packet is abnormal traffic, send a traffic abnormality notification to the terminal device, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • the sending module 1003 is specifically configured to add the traffic abnormality notification to a data message.
  • the determining module 1003 is specifically configured to receive the traffic abnormality notification from the data analytics network element or a control plane network element.
  • the determining module 1003 includes:
  • a receiving submodule 10031 configured to: receive a service type that is from the data analytics network element or the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, and receive a service type that is from the data analytics network element and that is of the first data packet;
  • an abnormal traffic determining submodule 10032 configured to determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the user plane apparatus 1000 further includes a traffic buffering module 1005 , configured to: after the determining module 1003 determines that the traffic corresponding to the first data packet is abnormal traffic, stop sending a data packet corresponding to the abnormal traffic and buffer the data packet corresponding to the abnormal traffic.
  • a traffic buffering module 1005 configured to: after the determining module 1003 determines that the traffic corresponding to the first data packet is abnormal traffic, stop sending a data packet corresponding to the abnormal traffic and buffer the data packet corresponding to the abnormal traffic.
  • the user plane apparatus 1000 further includes: a traffic processing module 1006 .
  • the receiving module 1001 is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality.
  • the traffic processing module 1006 is configured to: when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic, discard the data packet that corresponds to the abnormal traffic and is buffered by the user plane apparatus; or when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not abnormal traffic, send the data packet that corresponds to the abnormal traffic and is buffered by the user plane apparatus.
  • the user plane apparatus further includes: a sending module 1004 .
  • the receiving module 1001 is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality.
  • the sending module 1004 is further configured to send the traffic abnormality answer to the data analytics network element.
  • a terminal device 1100 provided in an embodiment of this application includes: a sending module 1101 , configured to send hotspot indication information to a core network network element, where the hotspot indication information includes that a hotspot switch is enabled; and an obtaining module 1102 , configured to obtain a traffic abnormality notification from the core network network element based on the hotspot indication information.
  • the sending module 1101 is further configured to send, to the core network network element, a service type that the terminal device does not allow or allows to be used in the period in which the hotspot switch is enabled.
  • the terminal device when performing reporting to the core network network element, may add, when sending first-time Wi-Fi hotspot information to the core network network element, the service type that the terminal does not allow or allows to be used in the period in which the Wi-Fi hotspot is enabled.
  • the sending module 1101 is further configured to: after the obtaining module 1102 obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, send a traffic abnormality answer to the core network network element, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality.
  • the terminal device 1100 further includes an abnormality processing module 1103 , configured to: after the obtaining module 1102 obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, disable the hotspot based on the traffic abnormality notification; or disable a connection that is of a hotspot user and that generates abnormal traffic; or prohibit a service type generating abnormal traffic from using the hotspot.
  • an abnormality processing module 1103 configured to: after the obtaining module 1102 obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, disable the hotspot based on the traffic abnormality notification; or disable a connection that is of a hotspot user and that generates abnormal traffic; or prohibit a service type generating abnormal traffic from using the hotspot.
  • the core network network element includes at least one of: a control plane function network element, a user plane function network element, a policy network element, and a data analytics network element.
  • the terminal device sends the hotspot indication information to the core network network element, and the terminal device obtains the traffic abnormality notification from the core network network element based on the hotspot indication information, so that the terminal device may determine, based on the traffic abnormality notification, data packets corresponding to abnormal traffic.
  • an embodiment of this application further provides a data analytics network element 1200 .
  • the data analytics network element 1200 includes:
  • an obtaining module 1201 configured to obtain a service type that a terminal device allows or does not allow to be used in a period in which a Wi-Fi hotspot switch is enabled;
  • a receiving module 1202 configured to receive a characteristic parameter of a first data packet from a user plane function network element, where the first data packet is a data packet obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled;
  • a service type determining module 1203 configured to determine, based on the characteristic parameter of the first data packet, a service type of the first data packet;
  • an abnormal traffic determining module 1204 configured to determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that traffic corresponding to the first data packet is abnormal traffic.
  • the data analytics network element 1200 further includes: a sending module 1203 , configured to send, after the abnormal traffic determining module 1204 determines that the traffic corresponding to the first data packet is abnormal traffic, a traffic abnormality notification to a control plane function network element or the user plane function network element, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • a sending module 1203 configured to send, after the abnormal traffic determining module 1204 determines that the traffic corresponding to the first data packet is abnormal traffic, a traffic abnormality notification to a control plane function network element or the user plane function network element, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • the obtaining module 1201 is specifically configured to: obtain, based on training data, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; or receive the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled and that is from the terminal device.
  • the receiving module 1202 is further configured to receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and the data analytics network element updates, based on the traffic abnormality answer, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • an embodiment of this application further provides a data analytics network element 1300 , including:
  • an obtaining module 1301 configured to obtain a service type that a terminal device allows or does not allow to be used in a period in which a Wi-Fi hotspot switch is enabled;
  • a sending module 1302 configured to send, to a user plane function network element or a control plane function network element, the service type that the terminal device allows to be used in the period in which the hotspot switch is enabled;
  • a receiving module 1303 configured to receive a characteristic parameter of a first data packet from the user plane function network element, where the first data packet is data obtained by the user plane function network element in the period in which the hotspot switch of the terminal device is enabled;
  • a service type determining module 1304 configured to determine, based on the characteristic parameter of the first data packet, a service type of the first data packet;
  • the sending module 1302 further configured to send the service type of the first data packet to the user plane function network element or the control plane function network element.
  • the obtaining module 1301 is specifically configured to obtain, based on training data, the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled.
  • the data analytics network element may obtain the service type of the first data packet from the user plane function network element, and may determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic, thereby accurately identifying the abnormal traffic and improving traffic management.
  • control plane function network element 1400 including:
  • a receiving module 1401 configured to receive hotspot indication information from a terminal device, where the hotspot indication information includes that a hotspot switch of the terminal device is enabled;
  • the receiving module 1401 further configured to receive a characteristic parameter of a first data packet from a user plane function network element;
  • a sending module 1402 configured to send the characteristic parameter of the first data packet to a data analytics network element, where the first data packet is data obtained by the user plane function network element in a period in which the hotspot switch of the terminal device is enabled;
  • an abnormal traffic determining module 1403 configured to determine that the traffic corresponding to the first data packet is abnormal traffic.
  • the sending module 1402 is further configured to: after the abnormal traffic determining module 1403 determines that the traffic corresponding to the first data packet is abnormal traffic, send a traffic abnormality notification to the terminal device, where the traffic abnormality notification is used to notify that the traffic corresponding to the first data packet is abnormal traffic.
  • the sending module 1402 is specifically configured to add the traffic abnormality notification to control signaling.
  • the control signaling may use, but is not limited to using, two procedure messages in the following examples.
  • One is a Service Request procedure initiated by a network side, and the traffic abnormality notification is carried in a Paging message for transmission to UE.
  • the other one is a PDU Session Modification procedure initiated by the network side, and the traffic abnormality notification is carried in a PDU Session Modification Accept message for transmission to the UE.
  • the abnormal traffic determining module 1403 is specifically configured to receive the traffic abnormality notification from the data analytics network element or the user plane function network element.
  • the abnormal traffic determining module 1403 is specifically configured to: receive a service type that is from the data analytics network element or the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; receive a service type that is from the data analytics network element or the terminal device and that is of the first data packet; and determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the abnormal traffic determining module 1403 is specifically configured to: receive a service type that is from the terminal device and that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled; receive a service type that is from the data analytics network element or the terminal device and that is of the first data packet; and determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic.
  • the sending module 1402 is further configured to: after the abnormal traffic determining module determines that the traffic corresponding to the first data packet is abnormal traffic, instruct the user plane function network element to stop sending the traffic corresponding to the first data packet, and to buffer the traffic corresponding to the first data packet.
  • the receiving module 1401 is further configured to: receive a traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and the sending module is further configured to: when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is abnormal traffic, instruct the user plane function network element to discard the buffered data packet corresponding to the abnormal traffic; or when it is determined, based on the traffic abnormality answer, that the traffic corresponding to the first data packet is not abnormal traffic, instruct the user plane function network element to forward the buffered data packet corresponding to the abnormal traffic.
  • the receiving module 1401 is further configured to receive the traffic abnormality answer from the terminal device, where the traffic abnormality answer includes that: there is traffic abnormality or there is no traffic abnormality; and the control plane function network element forwards the traffic abnormality answer to the data analytics network element.
  • the control plane function network element may obtain the service type of the first data packet from the user plane function network element, and may determine, based on the service type that the terminal device allows or does not allow to be used in the period in which the hotspot switch is enabled, that the traffic corresponding to the first data packet is abnormal traffic, thereby accurately identifying abnormal traffic and improving traffic management.
  • An embodiment of this application further provides a computer storage medium.
  • the computer storage medium stores a program, and the program, when executed, performs some or all of the steps described in the foregoing method embodiments.
  • the user plane apparatus 1500 includes:
  • a receiver 1501 , a transmitter 1502 , a processor 1503 , and a memory 1504 (a quantity of the processors 1503 in the user plane apparatus 1500 may be one or more, and an example in which there is one processor is used in FIG. 15 ).
  • the receiver 1501 , the transmitter 1502 , the processor 1503 , and the memory 1504 may be connected by using a bus or in another manner. Connection by using the bus is used as an example in FIG. 15 .
  • the memory 1504 may include a read-only memory and a random access memory, and provide an instruction and data to the processor 1503 .
  • a part of the memory 1504 may further include a non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1504 stores an operating system and an operation instruction, an executable module, or a data structure, or a subset thereof, or an extended set thereof.
  • the operation instruction may include various operation instructions used to implement various operations.
  • the operating system may include various system programs configured to implement various basic services and process a hardware-based task.
  • the processor 1503 controls an operation of the user plane apparatus, and the processor 1503 may be further referred to as a central processing unit (CPU).
  • CPU central processing unit
  • components of the user plane apparatus are coupled together through a bus system.
  • the bus system further includes a power bus, a control bus, a state signal bus, or the like.
  • various types of buses are marked as the bus system in FIG. 15 .
  • the method disclosed in the foregoing embodiments of this application may be applied to the processor 1503 , or may be implemented by the processor 1503 .
  • the processor 1503 may be an integrated circuit chip and has a signal processing capability. In an implementation process, steps in the foregoing methods can be implemented by using a hardware integrated logical circuit in the processor 1503 , or by using instructions in the form of software.
  • the processor 1503 may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or another programmable logical device, a discrete gate or transistor logic device, or a discrete hardware component. It may implement or perform the methods, the steps, and logical block diagrams that are disclosed in the embodiments of this application.
  • the general purpose processor may be a microprocessor, or the processor may be any conventional processor or the like. Steps of the methods disclosed with reference to the embodiments of this application may be directly executed and accomplished by means of a hardware decoding processor, or may be executed and accomplished by using a combination of hardware and software modules in the decoding processor.
  • a software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register.
  • the storage medium is located in the memory 1504 , and a processor 1503 reads information in the memory 1504 and completes the steps in the foregoing methods in combination with hardware of the processor.
  • the receiver 1501 may be configured to receive input number or character information, and generate signal input related to relevant settings of the user plane apparatus and to function control.
  • the transmitter 1502 may include a display screen or another display device, and the transmitter 1502 may be configured to output the number or character information through an external interface.
  • the receiver 1501 and the transmitter 1502 are configured to implement data receiving and sending.
  • the processor 1503 is configured to implement data receiving and sending through the receiver 1501 and the transmitter 1502 , to complete the data processing process performed by the foregoing user plane function network element.
  • the terminal device 1600 includes:
  • a receiver 1601 , a transmitter 1602 , a processor 1603 , and a memory 1604 (a quantity of the processors 1603 in the terminal device 1600 may be one or more, and an example in which there is one processor is used in FIG. 16 ).
  • the receiver 1601 , the transmitter 1602 , the processor 1603 , and the memory 1604 may be connected by using a bus or in another manner. Connection by using the bus is used as an example in FIG. 16 .
  • the memory 1604 may include a read-only memory and a random access memory, and provide an instruction and data to the processor 1603 .
  • a part of the memory 1604 may further include an NVRAM.
  • the memory 1604 stores an operating system and an operation instruction, an executable module, or a data structure, or a subset thereof, or an extended set thereof.
  • the operation instruction may include various operation instructions used to implement various operations.
  • the operating system may include various system programs configured to implement various basic services and process a hardware-based task.
  • the processor 1603 controls an operation of the terminal device, and the processor 1603 may further be referred to as a CPU.
  • components of the terminal device are coupled together through a bus system.
  • the bus system further includes a power bus, a control bus, a state signal bus, or the like.
  • various types of buses in the figure are marked as the bus system.
  • the method disclosed in the foregoing embodiments of the present invention may be applied to the processor 1603 , or may be implemented by the processor 1603 .
  • the processor 1603 may be an integrated circuit chip and has a signal processing capability.
  • steps in the foregoing methods can be implemented by using a hardware integrated logical circuit in the processor 1603 , or by using instructions in a form of software.
  • the foregoing processor 1603 may be a general purpose processor, a DSP, an ASIC, an FPGA or another programmable logical device, a discrete gate or transistor logic device, or a discrete hardware component. It may implement or perform the methods, the steps, and logical block diagrams that are disclosed in the embodiments of the present invention.
  • the general purpose processor may be a microprocessor, any conventional processor or the like. Steps of the methods disclosed with reference to the embodiments of the present invention may be directly executed and accomplished by means of a hardware decoding processor, or may be executed and accomplished by using a combination of hardware and software modules in the decoding processor.
  • a software module may be located in a storage medium known in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register.
  • the storage medium may be located in the memory 1604 , and a processor 1603 reads information in the memory 1604 and completes the steps in the foregoing methods in combination with the hardware of the processor.
  • the receiver 1601 and the transmitter 1602 are configured to implement data receiving and sending.
  • the processor 1603 is configured to implement data receiving and sending through the receiver 1601 and the transmitter 1602 , to complete the data processing process performed by the foregoing terminal device.
  • the data analytics network element 1700 includes:
  • the quantity of the processors 1703 in the data analytics network element 1700 may be one or more, and an example in which there is one processor is used in FIG. 17 ).
  • the receiver 1701 , the transmitter 1702 , the processor 1703 , and the memory 1704 may be connected via a bus or in another manner. Connection by using the bus is used as an example in FIG. 17 .
  • the memory 1704 may include a read-only memory and a random access memory, and provide an instruction and data to the processor 1703 .
  • a part of the memory 1704 may further include an NVRAM.
  • the memory 1704 stores an operating system, an operation instruction, an executable module, or a data structure, or a subset thereof, or an extended set thereof.
  • the operation instruction may include various operation instructions, to implement various operations.
  • the operating system may include various system programs configured to implement various basic services and process a hardware-based task.
  • the processor 1703 controls an operation of the data analytics network element, and the processor 1703 may further be referred to as a CPU.
  • components of the data analytics network element are coupled together through a bus system.
  • the bus system further includes a power bus, a control bus, a state signal bus, or the like.
  • various types of buses in the figure are marked as the bus system.
  • the method disclosed in the foregoing embodiments of the present invention may be applied to the processor 1703 , or may be implemented by the processor 1703 .
  • the processor 1703 may be an integrated circuit chip and has a signal processing capability.
  • steps in the foregoing methods can be implemented by using a hardware integrated logical circuit in the processor 1703 , or by using instructions in the form of software.
  • the foregoing processor 1703 may be a general purpose processor, a DSP, an ASIC, an FPGA or another programmable logical device, a discrete gate or transistor logic device, or a discrete hardware component. It may implement or perform the methods, the steps, and logical block diagrams that are disclosed in the embodiments of the present invention.
  • the general purpose processor may be a microprocessor, or the processor may be any conventional processor or the like. Steps of the methods disclosed with reference to the embodiments of the present invention may be directly executed and accomplished by means of a hardware decoding processor, or may be executed and accomplished by using a combination of hardware and software modules in the decoding processor.
  • a software module may be located in a storage medium known in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register.
  • the storage medium may be located in the memory 1704 , and a processor 1703 reads information in the memory 1704 and completes the steps in the foregoing methods in combination with hardware of the processor.
  • the receiver 1701 and the transmitter 1702 are configured to implement data receiving and sending.
  • the processor 1703 is configured to implement data receiving and sending through the receiver 1701 and the transmitter 1702 , to complete the data processing process performed by the foregoing data analytics network element.
  • control plane function network element 1800 includes:
  • a receiver 1801 , a transmitter 1802 , a processor 1803 , and a memory 1804 (a quantity of the processors 1803 in the control plane function network element 1800 may be one or more, and an example in which there is one processor is used in FIG. 18 ).
  • the receiver 1801 , the transmitter 1802 , the processor 1803 , and the memory 1804 may be connected via a bus or in another manner. Connection via a bus is used as an example in FIG. 18 .
  • the memory 1804 may include a read-only memory and a random access memory, and provide an instruction and data to the processor 1803 .
  • a part of the memory 1804 may further include an NVRAM.
  • the memory 1804 stores an operating system, an operation instruction, an executable module, or a data structure, or a subset thereof, or an extended set thereof.
  • the operation instruction may include various operation instructions, to implement various operations.
  • the operating system may include various system programs, configured to: implement various basic services and process a hardware-based task.
  • the processor 1803 controls an operation of the control plane function network element, and the processor 1803 may be further referred to as a CPU.
  • components of the control plane function network element are coupled together through a bus system.
  • the bus system further includes a power bus, a control bus, a state signal bus, or the like.
  • various types of buses in the figure are marked as the bus system.
  • the method disclosed in the foregoing embodiments of the present invention may be applied to the processor 1803 , or may be implemented by the processor 1803 .
  • the processor 1803 may be an integrated circuit chip and has a signal processing capability.
  • steps in the foregoing methods can be implemented by using a hardware integrated logical circuit in the processor 1803 , or by using instructions in the form of software.
  • the foregoing processor 1803 may be a general purpose processor, a DSP, an ASIC, an FPGA or another programmable logical device, a discrete gate or transistor logic device, or a discrete hardware component. It may implement or perform the methods, the steps, and logical block diagrams that are disclosed in the embodiments of the present invention.
  • the general purpose processor may be a microprocessor, any conventional processor or the like. Steps of the methods disclosed with reference to the embodiments of the present invention may be directly executed and accomplished by means of a hardware decoding processor, or may be executed and accomplished by using a combination of hardware and software modules in the decoding processor.
  • a software module may be located in a storage medium known in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register.
  • the storage medium may be located in the memory 1804 , and a processor 1803 reads information in the memory 1804 and completes the steps in the foregoing methods in combination with hardware of the processor.
  • the receiver 1801 and the transmitter 1802 are configured to implement data reception and transmission.
  • the processor 1803 is configured to implement data receiving and sending through the receiver 1801 and the transmitter 1802 , to complete the data processing process performed by the foregoing control plane function network element.
  • connection relationships between modules indicate that the modules have communication connections with each other, which may be specifically implemented as one or more communications buses or signal cables.
  • the technical solutions in the embodiments of this application essentially or the part contributing to the prior art may be implemented in a form of a software product.
  • the software product is stored in a readable storage medium, such as a floppy disk, a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc of a computer, and includes several instructions for instructing a computer device (which may be a personal computer, a server, a network device, and the like) to perform the methods described in the embodiments of this application.
  • a computer device which may be a personal computer, a server, a network device, and the like
  • All or some of the foregoing embodiments may be implemented by using software, hardware, firmware, or any combination thereof.
  • the embodiments may be implemented completely or partially in a form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable apparatuses.
  • the computer instruction may be stored in a computer-readable storage medium or may be transmitted from a computer-readable storage medium to another computer-readable storage medium.
  • the computer instruction may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired (such as a coaxial cable, an optical fiber, or a digital subscriber line (DSL)) or wireless (such as infrared, radio, or microwave) manner.
  • a wired such as a coaxial cable, an optical fiber, or a digital subscriber line (DSL)
  • wireless such as infrared, radio, or microwave
  • the computer-readable storage medium may be any usable medium accessible by a computer, or a data storage device, such as a server or a data center, integrating one or more usable media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a DVD), a semiconductor medium (for example, a solid-state drive (SSD)), or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • Cardiology (AREA)
  • General Health & Medical Sciences (AREA)
  • Environmental & Geological Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
US16/851,251 2017-10-23 2020-04-17 Traffic processing method, user plane apparatus, and terminal device Abandoned US20200244557A1 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
CN201710993953.6 2017-10-23
CN201710993953.6A CN109698760B (zh) 2017-10-23 2017-10-23 一种流量处理方法和用户面装置以及终端设备
PCT/CN2018/111222 WO2019080799A1 (zh) 2017-10-23 2018-10-22 一种流量处理方法和用户面装置以及终端设备

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/111222 Continuation WO2019080799A1 (zh) 2017-10-23 2018-10-22 一种流量处理方法和用户面装置以及终端设备

Publications (1)

Publication Number Publication Date
US20200244557A1 true US20200244557A1 (en) 2020-07-30

Family

ID=66225897

Family Applications (1)

Application Number Title Priority Date Filing Date
US16/851,251 Abandoned US20200244557A1 (en) 2017-10-23 2020-04-17 Traffic processing method, user plane apparatus, and terminal device

Country Status (4)

Country Link
US (1) US20200244557A1 (zh)
EP (1) EP3691209B1 (zh)
CN (1) CN109698760B (zh)
WO (1) WO2019080799A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10911326B2 (en) * 2018-05-21 2021-02-02 Samsung Electronics Co., Ltd Method and apparatus for utilizing data collection and analysis function in wireless communication system
US20210400525A1 (en) * 2018-02-20 2021-12-23 Microsoft Technology Licensing, Llc Dynamic Selection of Network Elements
WO2022033660A1 (en) * 2020-08-11 2022-02-17 Nokia Technologies Oy Apparatuses, methods, and computer programs for exchanging analytics data
WO2022061784A1 (zh) * 2020-09-25 2022-03-31 华为技术有限公司 通信方法、装置及系统
US11470017B2 (en) * 2019-07-30 2022-10-11 At&T Intellectual Property I, L.P. Immersive reality component management via a reduced competition core network component
CN115412308A (zh) * 2022-08-09 2022-11-29 北京天融信网络安全技术有限公司 报文处理方法、装置及电子设备
CN116114220A (zh) * 2020-08-07 2023-05-12 上海诺基亚贝尔股份有限公司 管理平面中的安全管理服务
WO2023151454A1 (zh) * 2022-02-14 2023-08-17 大唐移动通信设备有限公司 模型监控方法、监控端、装置及存储介质
EP4236410A4 (en) * 2020-10-30 2023-12-06 Huawei Technologies Co., Ltd. METHOD AND DEVICE FOR CONTROLLING AN ABNORMAL TERMINAL

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109982391B (zh) 2017-12-28 2023-04-11 华为技术有限公司 数据的处理方法及装置
CN111918280B (zh) * 2019-05-07 2022-07-22 华为技术有限公司 一种终端信息的处理方法、装置及系统
CN112104469B (zh) * 2019-06-17 2022-07-29 华为技术有限公司 数据处理方法及装置
WO2021062807A1 (zh) * 2019-09-30 2021-04-08 华为技术有限公司 一种通信方法、装置以及系统
CN113206814B (zh) * 2020-01-31 2022-11-18 华为技术有限公司 一种网络事件处理方法、装置及可读存储介质
CN115004653A (zh) * 2020-02-07 2022-09-02 华为技术有限公司 一种数据分析方法、装置及系统
EP4104481A4 (en) * 2020-02-10 2023-11-01 Nokia Technologies Oy SPREADING INFORMATION OF EU BAD BEHAVIOR
CN111314347A (zh) * 2020-02-19 2020-06-19 联想(北京)有限公司 一种非法流量的处理方法、装置、系统和存储介质
CN112291276B (zh) * 2020-12-28 2021-03-23 金锐同创(北京)科技股份有限公司 流量报警方法、装置及电子设备
CN116325686A (zh) * 2020-12-30 2023-06-23 华为技术有限公司 一种通信方法和装置
CN112969199B (zh) * 2021-02-24 2023-05-26 中国联合网络通信集团有限公司 一种数据采集方法和设备
CN114268957B (zh) * 2021-11-30 2023-07-04 中国联合网络通信集团有限公司 异常业务数据处理方法、装置、服务器及存储介质
CN117014922A (zh) * 2022-04-27 2023-11-07 维沃移动通信有限公司 行为处理方法、装置、终端、网络侧设备及介质

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101951551B (zh) * 2010-09-30 2013-06-05 上海顶竹通讯技术有限公司 一种带有无线局域网的网络以及终端接入无线局域网方法
US20150249910A1 (en) * 2014-02-28 2015-09-03 Carlos V. Roman Wireless network promotions
CN105451269A (zh) * 2014-07-04 2016-03-30 阿里巴巴集团控股有限公司 一种无线上网流量控制的方法和装置
US9078137B1 (en) * 2014-09-26 2015-07-07 Fortinet, Inc. Mobile hotspot managed by access controller
EP3329720B1 (en) * 2015-07-30 2020-07-15 Sony Corporation Mobile hotspot
WO2017016615A1 (en) * 2015-07-30 2017-02-02 Sony Mobile Communications Inc. Mobile hotspot
CN105577573B (zh) * 2015-12-31 2020-03-24 联想(北京)有限公司 一种信息处理方法及电子设备
CN105933928A (zh) * 2016-04-20 2016-09-07 努比亚技术有限公司 移动终端及其无线热点通信控制方法
CN105978826B (zh) * 2016-05-12 2019-04-16 中国联合网络通信集团有限公司 个人热点的流量控制方法和装置
CN107070669A (zh) * 2017-03-28 2017-08-18 新华三技术有限公司 一种终端的接入控制方法和装置

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210400525A1 (en) * 2018-02-20 2021-12-23 Microsoft Technology Licensing, Llc Dynamic Selection of Network Elements
US11997531B2 (en) * 2018-02-20 2024-05-28 Microsoft Technology Licensing, Llc Dynamic selection of network elements
US10911326B2 (en) * 2018-05-21 2021-02-02 Samsung Electronics Co., Ltd Method and apparatus for utilizing data collection and analysis function in wireless communication system
US11470017B2 (en) * 2019-07-30 2022-10-11 At&T Intellectual Property I, L.P. Immersive reality component management via a reduced competition core network component
US20220417174A1 (en) * 2019-07-30 2022-12-29 At&T Intellectual Property I, L.P. Immersive reality component management via a reduced competition core network component
CN116114220A (zh) * 2020-08-07 2023-05-12 上海诺基亚贝尔股份有限公司 管理平面中的安全管理服务
WO2022033660A1 (en) * 2020-08-11 2022-02-17 Nokia Technologies Oy Apparatuses, methods, and computer programs for exchanging analytics data
WO2022061784A1 (zh) * 2020-09-25 2022-03-31 华为技术有限公司 通信方法、装置及系统
EP4236410A4 (en) * 2020-10-30 2023-12-06 Huawei Technologies Co., Ltd. METHOD AND DEVICE FOR CONTROLLING AN ABNORMAL TERMINAL
WO2023151454A1 (zh) * 2022-02-14 2023-08-17 大唐移动通信设备有限公司 模型监控方法、监控端、装置及存储介质
CN115412308A (zh) * 2022-08-09 2022-11-29 北京天融信网络安全技术有限公司 报文处理方法、装置及电子设备

Also Published As

Publication number Publication date
EP3691209A1 (en) 2020-08-05
EP3691209A4 (en) 2020-10-21
CN109698760B (zh) 2021-05-04
CN109698760A (zh) 2019-04-30
WO2019080799A1 (zh) 2019-05-02
EP3691209B1 (en) 2021-12-08

Similar Documents

Publication Publication Date Title
US20200244557A1 (en) Traffic processing method, user plane apparatus, and terminal device
US10616868B2 (en) Method for connecting IMS-based service
USRE49636E1 (en) Method and apparatus of improving quality of calls in mobile communication system
US11277324B2 (en) Determining an execution policy of a service
US9628941B2 (en) MTC monitoring method
US20160227468A1 (en) Execution method and user equipment for service request procedure
US9854381B2 (en) Method for transmitting data of MTC device
US11044776B2 (en) Method for attempting network access from NB-IoT RAT
US20200120551A1 (en) Triggering selective fallback based on user subscription information
US11956756B2 (en) Request processing method and corresponding entity
US20150109917A1 (en) Mobile terminal of communication network having an information element and method of handling communication
US10149186B2 (en) Node and method for monitoring an ability of a wireless device to receive downlink data
JP4564074B2 (ja) 通信制御システム、無線制御装置及び通信制御方法
US10616119B2 (en) Policy determining method and apparatus
EP4070529A1 (en) User plane function load control
US10306520B2 (en) Handover method between heterogeneous wireless communication techniques and device for same
KR20150099367A (ko) 영상통화 서비스 품질을 높이는 방법 및 장치
CN111919501A (zh) 专用承载管理
EP3925307B1 (en) Technique for initiating a voice call in a mobile communication network
CN113259914A (zh) 网络分片数据速率的选择
US10470105B2 (en) Network status information transfer method and network device
US20230362862A1 (en) Multi-usim device accessing services of a second cellular network through a first cellular network via a gateway
US9860137B1 (en) Intelligent provisioning of service policy rules

Legal Events

Date Code Title Description
STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

AS Assignment

Owner name: HUAWEI TECHNOLOGIES CO.,LTD., CHINA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:NIE, SHENGXIAN;XIN, YANG;WU, XIAOBO;AND OTHERS;REEL/FRAME:053165/0011

Effective date: 20200622

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: FINAL REJECTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE AFTER FINAL ACTION FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: ADVISORY ACTION MAILED

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION